Description

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T11:16:34.180Z",
  "pubdate": "2026-09-12T11:16:34.180Z",
  "executiveSummary": "Msgpack-java versions through 0.9.12 are susceptible to a stack exhaustion vulnerability originating from insufficient recursion depth controls within the deserialization process.\nThe vulnerability type is categorized as a stack-based Denial of Service (DoS) resulting from uncontrolled recursion during the parsing of complex, nested data structures.\nThe flaw resides specifically within the MessageUnpacker.unpackValue() function, which lacks logic to validate the nesting depth of arrays or maps provided in the input stream.\nAn unauthenticated attacker can exploit this by crafting a malicious payload containing deeply nested MessagePack objects.\nUpon processing such a payload, the application's deserializing thread is forced to allocate excessive stack frames, inevitably triggering a java.lang.StackOverflowError.\nThis outcome leads to per-request deserialization failures and, depending on the implementation, may cause the termination of the affected thread or destabilization of the JVM process.\nThe risk implication is significant for applications that ingest untrusted or externally sourced MessagePack data, as it allows for trivial service disruption without requiring elevated privileges.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the MessageUnpacker.unpackValue() method within msgpack-java. This component recursively parses nested structures (arrays and maps) as it encounters them in the input byte stream.\nWhen MessageUnpacker encounters an array or map identifier, it enters a recursive cycle where it calls itself to resolve nested elements. The implementation fails to maintain an internal counter or check against a maximum nesting depth constant, effectively allowing the recursion depth to be limited only by the thread's native stack size.\nThe attack flow proceeds as follows: An attacker sends a maliciously crafted MessagePack byte sequence designed with arbitrary, excessive nesting depth (e.g., thousands of nested array headers).\nAs the MessageUnpacker.unpackValue() function processes this stream, it continuously pushes new stack frames to the Java thread's execution stack for each layer of nesting.\nBecause there is no validation logic to cap this depth, the thread eventually exhausts its pre-allocated stack memory. This trigger results in an unhandled java.lang.StackOverflowError, causing the immediate crash of the specific deserialization operation.\nThe impact is primarily a Denial of Service. In a typical server-side context, if the MessageUnpacker is used to process incoming API requests, this error can prevent the application from processing legitimate traffic.\nIf the thread is not properly managed by the surrounding framework, this exception may propagate, potentially leading to cascading failures or intermittent service instability.\nThis vulnerability does not require authentication or specific privilege levels to trigger; it is reachable as long as the application allows users to submit MessagePack-encoded data structures to the vulnerable deserializer. The exposure is limited to the protocol handling layer of the application using the library."
}