CVE-2026-90473 Overview
CVE-2026-90473 is an integer overflow vulnerability [CWE-190] in msgpack-java versions through 0.9.12. The flaw resides in MessageUnpacker.skipValue() when processing MAP32 containers with attacker-controlled element counts. An attacker who supplies a MAP32 element count at or above 0x40000000 triggers an integer wrap when the value is doubled to account for key/value pairs. The resulting arithmetic desynchronizes the parser cursor, causing attacker-controlled bytes to be returned in place of legitimate downstream fields.
Critical Impact
Applications that deserialize untrusted MessagePack data may return attacker-controlled bytes for later fields, enabling data integrity violations across systems consuming msgpack-java output.
Affected Products
- msgpack-java versions through 0.9.12
- Java applications embedding the msgpack-core library
- Downstream services that deserialize untrusted MessagePack payloads
Discovery Timeline
- 2026-09-12 - CVE-2026-90473 published to NVD
- 2026-09-12 - Last updated in NVD database
Technical Details for CVE-2026-90473
Vulnerability Analysis
The MessagePack format encodes maps using type markers such as MAP16 and MAP32, where the marker is followed by an element count and a sequence of key/value entries. In msgpack-java, MessageUnpacker.skipValue() iterates over these entries to advance the read cursor past a map without materializing its contents. For MAP32 containers, the parser reads a 32-bit unsigned element count and multiplies it by two to derive the total number of items to skip.
When the supplied element count is at or above 0x40000000, the doubled value exceeds the signed 32-bit integer range and wraps to a small or negative number. The loop then skips far fewer entries than the map actually contains. Subsequent reads pull bytes from inside the map body while the caller believes it is reading later, structurally distinct fields.
This desynchronization allows an attacker who controls any part of a MessagePack payload to influence how later fields are interpreted by the consuming application, undermining the integrity of deserialized data.
Root Cause
The root cause is unchecked signed integer arithmetic in the MAP32 handling path of MessageUnpacker.skipValue(). The element count is treated as a Java int and doubled without validating that the multiplication remains within the positive int range, satisfying the conditions for [CWE-190: Integer Overflow or Wraparound].
Attack Vector
Exploitation requires the target application to call skipValue() on a MessagePack stream sourced from an untrusted party. The attacker crafts a payload containing a MAP32 marker with an element count of 0x40000000 or higher, followed by chosen bytes intended to substitute for later fields. No authentication or user interaction is required when the deserializer is exposed over a network protocol.
Refer to the VulnCheck Advisory for msgpack-java and GitHub msgpack-java Issue #1014 for the vulnerable code path documented at MessageUnpacker.java lines 573-581.
Detection Methods for CVE-2026-90473
Indicators of Compromise
- MessagePack payloads containing MAP32 markers (0xdf) followed by element counts of 0x40000000 or higher.
- Application logs showing type mismatches, deserialization exceptions, or unexpected field values downstream of MessageUnpacker calls.
- Repeated malformed MessagePack requests originating from the same client or network segment.
Detection Strategies
- Perform software composition analysis (SCA) to inventory Java projects depending on org.msgpack:msgpack-core at versions at or below 0.9.12.
- Instrument deserialization boundaries to log MAP32 element counts and reject values above a documented business maximum.
- Add fuzzing or negative test cases to CI pipelines that exercise skipValue() with oversized MAP32 counts.
Monitoring Recommendations
- Monitor application error rates and parser exceptions on services accepting MessagePack input from external clients.
- Capture and retain raw payload samples at ingress proxies to support post-incident analysis of malformed maps.
- Alert on anomalous request sizes on endpoints that consume MessagePack, since large MAP32 counts often correlate with elevated payload volume.
How to Mitigate CVE-2026-90473
Immediate Actions Required
- Inventory all Java services that depend on msgpack-java0.9.12 or earlier and prioritize those exposed to untrusted input.
- Upgrade msgpack-core to a fixed release once published by the maintainers, tracked via GitHub msgpack-java Issue #1014.
- Enforce strict schema validation on deserialized MessagePack objects before their contents cross trust boundaries.
Patch Information
At the time of publication, remediation status should be verified against the upstream GitHub msgpack-java Repository and the VulnCheck Advisory for msgpack-java. Consumers should pin dependencies to a version that includes bounds checking on MAP32 element counts in MessageUnpacker.skipValue().
Workarounds
- Wrap MessageUnpacker calls with a pre-parser that inspects MAP32 markers and rejects element counts at or above 0x40000000.
- Cap the maximum accepted payload size at network ingress to constrain the feasibility of large-map attacks.
- Where feasible, replace skipValue() with explicit field-by-field unpacking that validates each key and value type against an expected schema.
# Configuration example: enforce a fixed msgpack-core version via Maven
mvn versions:use-dep-version -Dincludes=org.msgpack:msgpack-core -DdepVersion=<fixed-version> -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
