---
id: CVE-2026-90472
title: >-
  msgpack-java through 0.9.12 contains a stack overflow vulnerability in
  MessageUnpacker.unpackValue() that recursively deserializes arrays and maps
  without nesting depth limits
summary: >-
  msgpack-java through 0.9.12 contains a stack overflow vulnerability in
  MessageUnpacker.unpackValue() that recursively deserializes arrays and maps
  without nesting depth limits. Attackers can craft payloads with deeply nested
  arrays to ex…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-674
vendor: msgpack
product: msgpack-java
affected:
  - msgpack-java <= 0.9.12
published: '2026-09-12'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90472'
references:
  - url: 'https://github.com/msgpack/msgpack-java'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664
    label: disclosure@vulncheck.com
  - url: 'https://github.com/msgpack/msgpack-java/issues/1015'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays
    label: disclosure@vulncheck.com
  - url: 'https://github.com/msgpack/msgpack-java/issues/1015'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00566
epssPercentile: 0.44654
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T16:06:11.593754Z'
ingestedAt: '2026-09-14T15:23:07.480Z'
---

## Overview

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.