CVE-2026-90473 — msgpack-java through 0.9.12 Integer Overflow via MAP32
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can s…
Published: 2026-09-12 · CVSS: 6.9 · CVSS 4.0
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7