Skip to content

Product

redhat/msgpack-core vulnerabilities

2 published CVES affecting redhat/msgpack-core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest redhat/msgpack-core CVEs

Newest publication first

  1. CVE-2026-90473 msgpack-java through 0.9.12 Integer Overflow via MAP32

    Published
    MediumCVSS 6.9 EPSS 0.41%

    msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor t...

  2. CVE-2026-90472 msgpack-java through 0.9.12 Stack Overflow via Nested Arrays

    Published
    MediumCVSS 6.9 EPSS 0.57%

    msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.