CVE-2026-21452: MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Summary
CVE-2026-21452: MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation. Affects org.msgpack:msgpack-core versions < 0.9.11. Fixed in 0.9.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MessagePack for Java is a serialization library that allows for efficient data interchange between programming languages. It is widely used for its compact binary format and ease of use in various applications, including data storage and communication. However, it has been found to be vulnerable to a denial-of-service (DoS) attack when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths.
Vulnerability Detail
The vulnerability arises from the way MessagePack for Java handles EXT32 objects during deserialization. When the library processes extension headers, it trusts the declared EXT payload length without enforcing an upper limit. This can lead to unbounded heap allocation when the payload length is excessively large, resulting in JVM heap exhaustion, process termination, or service unavailability. The attack can be executed remotely, making it particularly dangerous for applications that deserialize untrusted .msgpack files, such as model registries and cloud-based services.
How To Fix
Minimum fixed version
0.9.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation to restrict the size of payloads being deserialized. This can help mitigate the risk of triggering the vulnerability until a proper update can be applied.
Conclusion
CVE-2026-21452 poses a significant risk to applications using MessagePack for Java due to its potential for remote denial-of-service attacks. It is crucial to update to version 0.9.11 or later to mitigate this vulnerability and ensure the stability of your applications.
See every vulnerability recorded for org.msgpack:msgpack-core →
FAQ
CVE-2026-21452 is a vulnerability in MessagePack for Java that allows for remote denial-of-service attacks through malicious EXT payload allocations.
An attacker can craft a .msgpack file with an EXT32 object that has a large payload length, which can lead to unbounded memory allocation and service unavailability.
The vulnerability can cause JVM heap exhaustion, leading to application crashes, service downtime, and potential cascading failures in production systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your application's pom.xml file on the Vulert playground, you can determine if it is affected by this vulnerability.
Implement input validation to limit the size of payloads being deserialized as a temporary workaround until you can upgrade to the patched version.
