Medium severity · published Sep 12, 2026
CVE-2026-90472
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
msgpack-java · msgpack
through 0.9.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90472
github.com
https://github.com/msgpack/msgpack-java
github.com
https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664
github.com
https://github.com/msgpack/msgpack-java/issues/1015
www.vulncheck.com
https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays
More from msgpack-java
7.5
CVE-2026-21452
MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation
5.3
CVE-2026-90473
msgpack-java through 0.9.12 Integer Overflow via MAP32