CVE-2026-90473 in msgpack-java
Summary
by MITRE • 09/12/2026
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in msgpack-java versions through 0.9.12 represents a critical integer overflow flaw within the MessageUnpacker.skipValue() method, specifically affecting the parsing logic for MAP32 container types. In the MessagePack binary serialization format, containers such as maps can specify their size using different encoding schemes depending on the number of elements. The MAP32 type is designed to handle large collections by storing the element count in a 32-bit unsigned integer field. When processing these structures, the parser must allocate memory and manage internal cursors based on this declared size. However, the implementation contains a logical error where it performs arithmetic operations that assume safe bounds for signed integers without adequate validation of the input data range.
The core technical flaw occurs when an attacker supplies a MAP32 element count value at or above 0x40000000. In this scenario, internal calculations involving doubling this value to determine buffer sizes or iteration limits result in integer overflow due to signed arithmetic wrapping behavior. Instead of rejecting the malformed input as invalid, the parser proceeds with corrupted size estimates. This leads directly to a desynchronization of the parsing cursor relative to the actual byte stream structure. The parser loses track of where it is within the serialized data because its internal state no longer aligns with the true layout of the MessagePack document being processed.
The operational impact of this vulnerability is severe, primarily manifesting as incorrect data retrieval and potential denial of service conditions. Because the cursor desynchronizes from the actual data stream, subsequent read operations may return attacker-controlled data in place of legitimate fields that were intended to follow the malformed map container. This effectively allows an adversary who controls the input payload to manipulate application logic by injecting false values into critical variables or configuration parameters processed after the vulnerable section. In scenarios where this library is used for deserializing untrusted network traffic, such as API requests or message queue payloads, this can lead to privilege escalation, data integrity violations, or complete system compromise depending on how the deserialized objects are utilized by the host application.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and falls under MITRE ATT&CK techniques related to Injection via Deserialization of Untrusted Data. The lack of proper boundary checks allows an external actor to influence program flow through malformed structured data. To mitigate this risk, organizations must immediately upgrade msgpack-java to a version newer than 0.9.12 where the integer overflow has been patched with appropriate range validation for MAP32 sizes. Additionally, developers should implement strict input validation policies that reject any serialized payloads exceeding expected size limits before they reach the deserialization engine. Enabling sandboxing or using dedicated untrusted data processing environments can further limit the blast radius if such vulnerabilities are encountered in legacy systems where immediate patching is not feasible.