CVE-2026-90472mediumCWE-674

CVE-2026-90472: medium-severity vulnerability in msgpack-java

msgpack-java through 0.9.12 Stack Overflow via Nested Arrays

Published · Updated

Follow this CVE+ Monitor msgpack-java+ Monitor msgpack-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
msgpack · msgpack-java
Related CVEs — msgpack-java

In the same product, most dangerous first.

CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-90473MEDIUMmsgpack-java through 0.9.12 Integer Overflow via MAP32EPSS 0.4%