{"id":"CVE-2026-90472","state":"PUBLISHED","title":"msgpack-java through 0.9.12 Stack Overflow via Nested Arrays","description":"msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.","publishedAt":"2026-09-12T11:06:11.553Z","updatedAt":"2026-09-24T14:21:43.291Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["msgpack msgpack-java"],"affected":[{"vendor":"msgpack","product":"msgpack-java","packageURL":"pkg:maven/org.msgpack/msgpack-core","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.9.12","versionType":"semver"}]}],"references":["https://github.com/msgpack/msgpack-java/issues/1015","https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664","https://github.com/msgpack/msgpack-java","https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays"],"weaknesses":["CWE-674"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90472.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90472","state":"PUBLISHED","datePublished":"2026-09-12T11:06:11.553Z","dateUpdated":"2026-09-24T14:21:43.291Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-12T02:03:23.163Z"},"containers":{"cna":{"title":"msgpack-java through 0.9.12 Stack Overflow via Nested Arrays","descriptions":[{"lang":"en","value":"msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures."}],"affected":[{"vendor":"msgpack","product":"msgpack-java","packageURL":"pkg:maven/org.msgpack/msgpack-core","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.9.12","versionType":"semver"}]}],"references":[{"url":"https://github.com/msgpack/msgpack-java/issues/1015","tags":["issue-tracking"],"name":"GitHub Issue #1015"},{"url":"https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664","tags":["technical-description"],"name":"MessageUnpacker.unpackValue() ARRAY and MAP recursion at v0.9.12"},{"url":"https://github.com/msgpack/msgpack-java","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays","name":"VulnCheck Advisory: msgpack-java through 0.9.12 Stack Overflow via Nested Arrays","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","lang":"en","description":"Uncontrolled Recursion","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-24T14:21:43.291Z"},"datePublic":"2026-08-07T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:java:*:*","versionEndIncluding":"0.9.12"}]}]}],"credits":[{"lang":"en","value":"Wayde Shi (PayPal Cyber Security Team)","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/msgpack/msgpack-java/issues/1015","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-14T16:06:11.593754Z","id":"CVE-2026-90472","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-14T16:08:11.280Z"}}]}}}