Executive brief
msgpack-java is a serialization library used to convert data structures into a compact binary format and back. An integer overflow vulnerability in the message parser allows attackers to send specially crafted MAP32 containers that desynchronize the parser, causing attacker-controlled data to be returned in place of legitimate fields. This could lead to data corruption, bypass of validation logic, or injection attacks in applications using this library.
Technical details
The vulnerability is an integer overflow in the MessageUnpacker.skipValue() method when processing MAP32 (32-bit map) containers. An attacker can supply a MAP32 element count at or above 0x40000000 that wraps to a negative or small positive value when doubled, causing a length calculation to overflow. This causes the parser cursor to desynchronize from the actual message stream position, resulting in attacker-controlled data being returned in place of legitimate fields. The vulnerability affects msgpack-java through version 0.9.12. No network authentication is required; attackers need only the ability to send a crafted msgpack message to a vulnerable application.
Affected products
- msgpack msgpack-java through 0.9.12
Timeline
- 2026-09-12: disclosed