CVE-2026-21452 vulnerabilities

Vulnerabilities for packages: floci-az, camunda-zeebe...

ai.mantik:ds_2.12 (>=0.3.0-rc3, <=0.3.1-rc2), ai.mantik:ds_2.13 (>=0.4.0-rc1, <=0.4.0) +1551 more potentially affected by CVE-2026-21452 via org.msgpack:msgpack-core (>=0.7.0-m1, <=0.9.10)

org.msgpack:msgpack-core MAVEN version =0.7.0-m1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2026-21452 Source advisory:...

CVE-2026-21452

MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later...

ai.mantik:ds_2.12 (>=0.3.0-rc3, <=0.3.1-rc2), ai.mantik:ds_2.13 (>=0.4.0-rc1, <=0.4.0) +1551 more potentially affected by CVE-2026-21452 via org.msgpack:msgpack-core (>=0.7.0-m1, <=0.9.10)

org.msgpack:msgpack-core MAVEN version =0.7.0-m1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.3.0-rc3, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2026-21452 Source advisory:...

CVE-2026-21452

creationtimestamp| type| source ---|---|--- 2026-01-02 18:50:31+00:00| published-proof-of-concept| https://github.com/msgpack/msgpack-java/security/advisories/GHSA-cw39-r4h6-8j3x 2026-01-03 00:08:40+00:00| published-proof-of-concept| Telegram/DFhOoz2ba5lY6tfZKWDQmHfJO-BCe0MWUTSMMxzWfmXNHIA...