Integer Overflow in msgpack-java MessageUnpacker.skipValue

Executive Summary

This is an integer overflow vulnerability in msgpack-java versions up to 0.9.12. When processing MAP32 containers with large element counts (at or above 0x40000000), the parser cursor desynchronizes due to an overflow when doubling the count. This allows attacker-controlled data to replace later fields in the message.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using msgpack-java versions up to 0.9.12. Check for MAP32 containers with element counts at or above 0x40000000. Use tools like dependency scanners to identify affected versions. Review logs for deserialization errors or parser misalignments.

Useful 0 Not Useful 0

Impact Analysis

Applications using MessageUnpacker to skip unknown fields may read unintended data, leading to potential data corruption or injection of malicious payloads. Systems like forward-compatible RPC frameworks, game servers, and IoT gateways are particularly affected.

Useful 0 Not Useful 0

Mitigation Strategies

Update msgpack-java to a patched version beyond 0.9.12. If updating is not possible, restrict input handling to trusted sources and validate MAP32 element counts. Monitor for parser desynchronization errors as potential exploitation attempts.

Useful 0 Not Useful 0