CVE-2026-21452 vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

CVE-2026-21452

MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later...

ai.mantik:ds_2.12 (>=0.3.0 <=0.3.1-rc2), ai.mantik:ds_2.13 (>=0.4.0 <=0.4.0-rc1) +1283 more potentially affected by CVE-2026-21452 via org.msgpack:msgpack-core (>=0.7.0-M6 <=0.9.10)

org.msgpack:msgpack-core MAVEN version =0.7.0-M6, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0-rc1 and more Source cves: CVE-2026-21452 Source advisory: SNYK:JAVA-ORGMSGPACK-14857714...

CVE-2026-21452

creationtimestamp| type| source ---|---|--- 2026-01-02 18:50:31+00:00| published-proof-of-concept| https://github.com/msgpack/msgpack-java/security/advisories/GHSA-cw39-r4h6-8j3x 2026-01-03 00:08:40+00:00| published-proof-of-concept| Telegram/DFhOoz2ba5lY6tfZKWDQmHfJO-BCe0MWUTSMMxzWfmXNHIA...