PT-2026-1132 · Unknown+1 · Messagepack For Java+1

Hyperps · Published 2026-01-02 · Updated 2026-05-18 · CVE-2026-21452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MessagePack for Java versions prior to 0.9.11

Description A denial-of-service issue exists in MessagePack for Java when processing .msgpack files. Specifically, versions before 0.9.11 are susceptible to unbounded heap allocation when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. The library trusts the declared EXT payload length during materialization, attempting to allocate a byte array of that size without any upper bound. A small, crafted .msgpack file can trigger JVM heap exhaustion, leading to process termination or service unavailability. This issue is triggered during model loading and deserialization, making it a model format issue suitable for remote exploitation. The attack requires no malformed bytes, user interaction, or elevated privileges and can be exploited remotely.

Recommendations Update MessagePack for Java to version 0.9.11 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-789

Related Identifiers

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CVE-2026-21452

GHSA-CW39-R4H6-8J3X

Affected Products

Debian

Messagepack For Java

References · 193

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21452.json · Exploit
• 🔥 https://github.com/msgpack/msgpack-java/security/advisories/GHSA-cw39-r4h6-8j3x · Exploit
• https://github.com/msgpack/msgpack-java/commit/daa2ea6b2f11f500e22c70a22f689f7a9debdeae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46120 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21452 · Vendor Advisory