CVE-2026-90473
msgpack-java through 0.9.12 Integer Overflow via MAP32
CVSS 4.0 6.9 MEDIUMCVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-90473
Publishedmsgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90473 · CVE overview and exploitation status
cve-program · CVE-2026-90473
- https://github.com/msgpack/msgpack-java/issues/1014
- https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L573-L581
- https://github.com/msgpack/msgpack-java
- https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-integer-overflow-via-map32
Related changes
Linked by CVE identifierNo related changes are available here.