CVE-2026-90472
Received Received - Intake

Stack Overflow in msgpack-java Library

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90472
EUVD
EUVD-2026-76848

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
msgpack msgpack-java to 0.9.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90472 is a stack overflow vulnerability in msgpack-java versions up to 0.9.12. The MessageUnpacker.unpackValue() method recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack, causing a StackOverflowError and per-request deserialization failures.

Detection Guidance

To detect this vulnerability, monitor for StackOverflowError exceptions in applications using msgpack-java 0.9.12 or earlier. Check logs for deserialization failures or crashes in threads processing MessagePack data. Use network traffic inspection tools to identify malformed deeply nested arrays in incoming payloads.

Impact Analysis

This vulnerability can cause denial-of-service (DoS) conditions by crashing the deserializing thread for each affected request. While the system remains operational, individual requests fail due to StackOverflowError. The minimal payload to trigger this is around 1,500 bytes with small stack sizes or 11,000 bytes with default settings, both feasible in HTTP requests.

Mitigation Strategies

Upgrade msgpack-java to a patched version beyond 0.9.12. Implement input validation to reject deeply nested arrays or maps. Add a maxNestingDepth parameter to UnpackerConfig or switch to an iterative deserialization approach. Monitor for StackOverflowError exceptions and restart affected threads if caught.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart