CVE-2026-90472

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...