Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck
CVE-2026-90472msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
Medium 5.3
In plain English
A medium-severity security flaw in msgpack-java from msgpack. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | msgpack-java | no fix listed | DEBIAN-CVE-2026-90472 |
| Debian:13 | msgpack-java | no fix listed | DEBIAN-CVE-2026-90472 |
| Debian:14 | msgpack-java | no fix listed | DEBIAN-CVE-2026-90472 |
| Ubuntu:22.04:LTS | msgpack-java | no fix listed | UBUNTU-CVE-2026-90472 |
| Ubuntu:24.04:LTS | msgpack-java | no fix listed | UBUNTU-CVE-2026-90472 |
| Ubuntu:26.04:LTS | msgpack-java | no fix listed | UBUNTU-CVE-2026-90472 |
| Ubuntu:26.10 | msgpack-java | no fix listed | UBUNTU-CVE-2026-90472 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| msgpack | msgpack-java | 0 – through 0.9.12 |
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Issue #1015 issue-tracking
- MessageUnpacker.unpackValue() ARRAY and MAP recursion at v0.9.12 technical-description
- https://github.com/msgpack/msgpack-java product
- VulnCheck Advisory: msgpack-java through 0.9.12 Stack Overflow via Nested Arrays third-party-advisory