CVE-2026-90472

27th percentile - higher than 27% of all known CVEs

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

The vulnerability allows an attacker to trigger deserialization failures, potentially leading to denial of service for applications processing untrusted msgpack data. It can disrupt service availability.

Update the msgpack-java library to a version later than 0.9.12. Until then, consider limiting input nesting depth or increasing the thread stack size.