Description
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
msgpack msgpack-java
Default version status: unaffected
0 to ≤ 0.9.12affected
pkg:maven/org.msgpack/msgpack-coreReferences
- https://github.com/msgpack/msgpack-java/issues/1014 ↗
- https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L573-L581 ↗
- https://github.com/msgpack/msgpack-java ↗
- https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-integer-overflow-via-map32 ↗