CVE-2026-90472: msgpack-java Buffer Overflow Vulnerability

CVE-2026-90472 Overview

CVE-2026-90472 is a stack overflow vulnerability [CWE-674] in the msgpack-java library through version 0.9.12. The flaw resides in MessageUnpacker.unpackValue(), which recursively deserializes MessagePack arrays and maps without enforcing a nesting depth limit. Attackers can submit crafted payloads containing deeply nested arrays to exhaust the deserializing thread's stack, triggering a StackOverflowError. The result is a per-request deserialization failure that affects availability of services consuming untrusted MessagePack input over the network.

Critical Impact
Unauthenticated attackers can send crafted MessagePack payloads to cause denial-of-service conditions in Java applications that deserialize untrusted input using msgpack-java.

Affected Products

msgpack-java through version 0.9.12
Java applications and services that call MessageUnpacker.unpackValue() on untrusted input
Downstream libraries and frameworks that embed vulnerable versions of msgpack-java

Discovery Timeline

2026-09-12 - CVE-2026-90472 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90472

Vulnerability Analysis

The vulnerability affects the MessageUnpacker class in msgpack-java, specifically the unpackValue() method responsible for materializing MessagePack values into Java objects. When the unpacker encounters an array or map type marker, it recursively invokes itself for each contained element to build the nested Value structure. No counter, depth guard, or iterative fallback constrains this recursion.

A payload of deeply nested arrays therefore drives recursion depth linearly with input structure. Once the JVM thread's stack space is exhausted, the runtime raises a StackOverflowError. Because the error surfaces from deserialization, the affected request or message-processing operation fails. Long-lived services that reuse threads generally recover after the error propagates, but each malicious payload reliably disrupts a single deserialization operation.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in MessageUnpacker.unpackValue(). The method does not accept or enforce a maximum nesting depth, and it does not convert nested container parsing into an iterative or bounded operation. Any caller that hands untrusted bytes to this method inherits the risk without a way to cap the recursion externally.

Attack Vector

Exploitation requires only network reachability to an endpoint that deserializes MessagePack data. The attacker constructs a payload consisting of nested array headers (for example, repeated MessagePack fixarray or array16 markers with a single child element each) until the nesting count exceeds available stack frames for the receiving thread. No authentication or user interaction is required. Refer to the VulnCheck Advisory for msgpack-java, GitHub Issue #1015, and the MessageUnpacker source for technical details.

Detection Methods for CVE-2026-90472

Indicators of Compromise

Application logs containing java.lang.StackOverflowError with stack frames referencing org.msgpack.core.MessageUnpacker.unpackValue.
Repeated deserialization failures tied to a single source IP or client identifier processing MessagePack payloads.
Anomalously small MessagePack requests that produce disproportionately deep parse trees in traces or metrics.

Detection Strategies

Instrument MessagePack ingestion points to record payload size, parse duration, and nesting depth, then alert on outliers.
Enable structured JVM error logging and aggregate StackOverflowError occurrences by class and method into your SIEM.
Perform software composition analysis on Java build artifacts to identify msgpack-core versions at or below 0.9.12.

Monitoring Recommendations

Track deserialization exception rates per endpoint and correlate spikes with client source addresses.
Monitor JVM thread health and request-error ratios for services exposing MessagePack APIs.
Forward application and web server logs to a centralized data lake for cross-service correlation of parser failures.

How to Mitigate CVE-2026-90472

Immediate Actions Required

Inventory all Java services that depend on msgpack-java directly or transitively and identify versions at or below 0.9.12.
Restrict network exposure of endpoints that deserialize MessagePack data from untrusted sources until a fix is deployed.
Enforce strict payload size limits at the reverse proxy or API gateway to reduce the surface for nested-payload abuse.

Patch Information

No fixed version is referenced in the enriched CVE data at the time of publication. Consult the msgpack-java GitHub repository and GitHub Issue #1015 for the current patch status and release notes before upgrading production dependencies.

Workarounds

Wrap calls to MessageUnpacker.unpackValue() in a try/catch for StackOverflowError and reject the request to prevent cascading failures.
Pre-scan incoming MessagePack byte streams to count nested container markers and reject payloads exceeding a conservative depth threshold.
Isolate MessagePack deserialization on threads with a bounded stack size and rate-limit clients that trigger parser errors.

bash

# Configuration example: enforce request size and depth limits at the gateway
# NGINX: cap MessagePack request bodies to reduce nested-payload exposure
client_max_body_size 64k;

# Application-level guard (pseudocode):
#   if (countNestedContainers(payload) > 100) { reject(); }
#   else { unpacker.unpackValue(); }