CVE-2026-90472CWE-674

CVE-2026-90472

Medium · published September 12, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-12T15:16Z
References (5)
https://github.com/msgpack/msgpack-java · [email protected]https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664 · [email protected]https://github.com/msgpack/msgpack-java/issues/1015 · [email protected]https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays · [email protected]https://github.com/msgpack/msgpack-java/issues/1015 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 12 SEP 11:06Z
    msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
    cvelistv5