Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to recursive deserialization in MessageUnpacker.unpackValue in msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java. An attacker can trigger StackOverflowError by supplying MessagePack payloads wit...

CVE-2026-90472

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CVE-2026-90472: Uncontrolled Recursion

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...