CVE-2026-90473 msgpack CVE debrief

Who should care

Defenders and developers using msgpack-java for data serialization and deserialization should assess exposure and verify the version in use. This vulnerability could impact data integrity and potentially lead to information disclosure if exploited.

Why it matters

CVE-2026-90473 is an integer overflow vulnerability in msgpack-java through version 0.9.12. It occurs in the MessageUnpacker.skipValue() method when processing MAP32 containers with large element counts. Defenders should assess exposure, particularly in systems using msgpack-java for data serialization and deserialization, as it could impact data integrity and potentially lead to information disclosure.

• Potential for information disclosure due to desynchronization of the parser cursor.
• Possible data integrity impacts if attacker-controlled data is returned in place of later fields.
• Verification of msgpack-java version and exposure is necessary.
• Patching or updating msgpack-java to a fixed version may be required.

Technical summary

The vulnerability is in the MessageUnpacker.skipValue() method of msgpack-java through version 0.9.12. When processing MAP32 containers with large element counts (at or above 0x40000000), an integer overflow occurs, causing the parser cursor to desynchronize. This desynchronization allows attacker-controlled data to be returned in place of later fields during the unpacking process. Defenders should assess exposure, particularly in systems using msgpack-java for data serialization and deserialization, as it could impact data integrity and potentially lead to information disclosure.

Defensive priority

Medium priority for systems using msgpack-java, especially in data serialization and deserialization processes.

Recommended defensive actions

• Assess exposure in systems using msgpack-java for data serialization and deserialization.
• Verify the version of msgpack-java in use and check for updates or patches.
• Monitor for potential information disclosure or data integrity impacts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the integer overflow vulnerability in msgpack-java. The vulnerability is in the MessageUnpacker.skipValue() method, which can lead to desynchronization of the parser cursor and return of attacker-controlled data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.