MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Date: 2026-01
Affected: maven/org.msgpack:msgpack-core
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-21452
CWE: CWE-400
CWE-789
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Summary Affected Components: ``` org.msgpack.core.MessageUnpacker.readPayload() org.msgpack.core.MessageUnpacker.unpackValue() org.msgpack.value.ExtensionValue.getData() ``` A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. ### PoC ``` import msgpack import struct import os OUTPUT_DIR = "bombs" os.makedirs(OUTPUT_DIR, exist_ok=True) # EXT format: fixext / ext8 / ext16 / ext32 # ext32 allows attacker-controlled length (uint32) length = 1 step = 10_000_000 while True: try: # EXT32: 0xC9 | length (4 bytes) | type (1 byte) header = b'\xC9' + struct.pack(">I", length) + b'\x01' payload = b'A' # actual data tiny data = header + payload fname = f"{OUTPUT_DIR}/ext_length_{length}.msgpack" with open(fname, "


Mitigations:

Architectural layers (MAESTRO):