Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.msgpack:msgpack-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation

    CVE-2026-21452 · GHSA-cw39-r4h6-8j3x

    Affected
    • Maven org.msgpack:msgpack-core < 0.9.11
    Fixed in
    0.9.11· Vendor fix available
    Issue
    Affected Components: A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. PoC Download dependency: curl -LO https://repo1.maven.org/maven2/org/msgpack/msgpack-core/0.9.8/msgpack-core-0.9.8.jar Java Reproducer Compile Run (with limited heap) Observed Result: Run: A…

    Recommended action: Upgrade to 0.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →