{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90472", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-12T02:03:23.163Z", "datePublished": "2026-09-12T11:06:11.553Z", "dateUpdated": "2026-09-14T16:08:11.280Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-12T11:06:11.553Z"}, "datePublic": "2026-08-07T00:00:00.000Z", "title": "msgpack-java through 0.9.12 Stack Overflow via Nested Arrays", "descriptions": [{"lang": "en", "value": "msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncontrolled Recursion", "cweId": "CWE-674", "type": "CWE"}]}], "affected": [{"vendor": "msgpack", "product": "msgpack-java", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "0.9.12", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:maven/org.msgpack/msgpack-core"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:java:*:*", "versionEndIncluding": "0.9.12"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/msgpack/msgpack-java/issues/1015", "tags": ["issue-tracking"], "name": "GitHub Issue #1015"}, {"url": "https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664", "tags": ["technical-description"], "name": "MessageUnpacker.unpackValue() ARRAY and MAP recursion at v0.9.12"}, {"url": "https://github.com/msgpack/msgpack-java", "tags": ["product"]}, {"name": "VulnCheck Advisory: msgpack-java through 0.9.12 Stack Overflow via Nested Arrays", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays"}], "credits": [{"lang": "en", "value": "Wayde Shi (PayPal Cyber Security Team)", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/msgpack/msgpack-java/issues/1015", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T16:06:11.593754Z", "id": "CVE-2026-90472", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T16:08:11.280Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90472", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T16:06:11.593754Z"}}}], "references": [{"url": "https://github.com/msgpack/msgpack-java/issues/1015", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T16:08:03.626Z"}}], "cna": {"title": "msgpack-java through 0.9.12 Stack Overflow via Nested Arrays", "credits": [{"lang": "en", "type": "reporter", "value": "Wayde Shi (PayPal Cyber Security Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "msgpack", "product": "msgpack-java", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.9.12"}], "packageURL": "pkg:maven/org.msgpack/msgpack-core", "defaultStatus": "unaffected"}], "datePublic": "2026-08-07T00:00:00.000Z", "references": [{"url": "https://github.com/msgpack/msgpack-java/issues/1015", "name": "GitHub Issue #1015", "tags": ["issue-tracking"]}, {"url": "https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664", "name": "MessageUnpacker.unpackValue() ARRAY and MAP recursion at v0.9.12", "tags": ["technical-description"]}, {"url": "https://github.com/msgpack/msgpack-java", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays", "name": "VulnCheck Advisory: msgpack-java through 0.9.12 Stack Overflow via Nested Arrays", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "Uncontrolled Recursion"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:java:*:*", "vulnerable": true, "versionEndIncluding": "0.9.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-12T11:06:11.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-90472", "state": "PUBLISHED", "dateUpdated": "2026-09-14T16:08:11.280Z", "dateReserved": "2026-09-12T02:03:23.163Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-12T11:06:11.553Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.msgpack/msgpack-core", "product": "msgpack-java", "vendor": "msgpack", "versions": [{"lessThanOrEqual": "0.9.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures."}], "id": "CVE-2026-90472", "lastModified": "2026-09-14T17:17:54.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90472", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T16:06:11.593754Z", "version": "2.0.3"}}]}, "published": "2026-09-12T11:16:34.180", "references": [{"source": "[email protected]", "url": "https://github.com/msgpack/msgpack-java"}, {"source": "[email protected]", "url": "https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664"}, {"source": "[email protected]", "url": "https://github.com/msgpack/msgpack-java/issues/1015"}, {"source": "[email protected]", "url": "https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/msgpack/msgpack-java/issues/1015"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "[email protected]", "type": "Secondary"}]}

{}

{"created": "2026-09-12T18:15:19.581986+00:00", "updated": "2026-09-14T16:45:05.431815+00:00", "vendors": []}