CVE-2026-90473 msgpack-java through 0.9.12 Integer Overflow via MAP32
Attackers can trigger an integer overflow in msgpack-java to desynchronize the parser and read attacker-controlled data, impacting applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90473?
CVE-2026-90473 is a medium-severity vulnerability in msgpack-java, published on 12 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Weakness: CWE-190
Which versions are affected by CVE-2026-90473?
How do I fix CVE-2026-90473?
No fix has been published for CVE-2026-90473 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90473 being exploited?
There is no known exploitation of CVE-2026-90473 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90473, GHSA-9vjp-f3jg-99pq, UBUNTU-CVE-2026-90473.