Executive brief
msgpack-java is a serialization library used in Java applications to encode and decode data. A vulnerability in versions through 0.9.12 allows attackers to craft specially crafted payloads with deeply nested structures that cause deserialization to fail with a stack overflow error, disrupting service availability for any application processing untrusted msgpack data.
Technical details
The vulnerability is a stack overflow (CWE-674: Uncontrolled Recursion) in the MessageUnpacker.unpackValue() method, which recursively deserializes arrays and maps without enforcing nesting depth limits. An attacker can send a crafted msgpack payload containing deeply nested arrays or maps to any application using msgpack-java that processes untrusted input. When the unpacker processes these nested structures, the recursive calls exhaust the JVM stack space, triggering a StackOverflowError and causing a denial of service on a per-request basis. No authentication or special network access is required—the vulnerability is triggered simply by deserializing a malicious payload. A patch restricting maximum nesting depth is required to fix this issue.
Affected products
- msgpack msgpack-java through 0.9.12
Timeline
- 2026-09-12: disclosed