TI-2026-17336 CVE-2026-21452 · GHSA-cw39-r4h6-8j3x
Uncontrolled resource consumption in msgpack-java
Priority HIGH 72
MessagePack for Java is a serializer implementation for Java.
msgpack
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
msgpack records in CISA KEVNo msgpack vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2026-61499 CVE-2026-90472 · GHSA-h5hr-vppv-v9cg
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
Priority HIGH 70
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits.
TI-2026-51079 CVE-2026-72854 · GHSA-p5jw-mm77-f8jp
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
Priority MEDIUM 59
msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already…
TI-2026-39368 CVE-2026-54522 · GHSA-4mrv-5p47-p938
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
Priority MEDIUM 44
MessagePack for Ruby is an implementation of the MessagePack binary serialization format.
TI-2026-79420 CVE-2026-114613 · GHSA-j586-36cw-2gc2
Memory leak in MessagePack C extension when map key validation fails
Priority MEDIUM 40
MessagePack is the serializer implementation for Python msgpack.org.
TI-2026-41435 CVE-2026-57585
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
Priority LOW 39
MessagePack is the serializer implementation for Python msgpack.org.
TI-2026-61500 CVE-2026-90473 · GHSA-9vjp-f3jg-99pq
msgpack-java through 0.9.12 Integer Overflow via MAP32
Priority LOW 37
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts.