CVE-2026-90473: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90473 is an integer overflow vulnerability in msgpack-java affecting all versions through 0.9.12. The flaw resides in the MessageUnpacker.skipValue() method within msgpack-core, where processing a MAP32 container with an element count at or above 0x40000000 causes the count variable to wrap to a large negative number when doubled, silently terminating the skip loop and desynchronizing the parser cursor. This allows attacker-controlled data to be returned in place of legitimate subsequent fields. It was disclosed on September 12, 2026, with a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, GitHub Issue).

The root cause is CWE-190 (Integer Overflow or Wraparound) in MessageUnpacker.java at lines 578–579. When skipValue() encounters a MAP32 format byte (0xdf), it reads a 32-bit element count via readNextLength32() (which returns a signed int) and multiplies by 2 to account for key-value pairs: count += readNextLength32() * 2. When the returned value is 0x40000000, the multiplication yields 0x80000000 (Integer.MIN_VALUE, i.e., -2147483648), making count immediately negative and causing the while (count > 0) loop to exit without consuming the map body. The existing source code even contains a // TODO check int overflow comment at the vulnerable line, confirming the defect was known but unaddressed. Only applications using MessageUnpacker.skipValue() directly are affected; the Jackson integration (MessagePackParser) does not call skipValue() and is unaffected (GitHub Issue, Vulnerable Source).

Successful exploitation causes parser state desynchronization: after skipValue() silently returns without consuming the MAP32 body, a subsequent read from the same stream consumes bytes that were intended to be skipped, returning attacker-controlled data in place of legitimate later fields. The primary impact is an integrity violation — applications that rely on field ordering (e.g., forward-compatible RPC frameworks, game servers, IoT gateways) may process injected values as trusted data. There is no confidentiality or availability impact, and no evidence of lateral movement potential beyond data tampering within the affected message stream (Github Advisory, GitHub Issue).

No public proof-of-concept exploit code has been released beyond the detailed PoC included in the original security disclosure issue, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable over the network against any exposed endpoint that deserializes msgpack data using MessageUnpacker.skipValue(). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify target: Locate a network-accessible service that accepts msgpack-encoded data and uses org.msgpack.core.MessageUnpacker with skipValue() to skip unknown fields (e.g., RPC endpoints, game servers, IoT gateways). Services using the Jackson integration are not vulnerable.
2. Craft malicious payload: Construct a msgpack byte sequence containing a fixarray wrapper followed by a MAP32 container with element count 0x40000000, then append the attacker-controlled data as the next element. The 12-byte PoC payload is: 92 df 40 00 00 00 a5 70 77 6e 65 64 (fixarray[2], MAP32 with size=0x40000000, fixstr "pwned").
3. Trigger the overflow: Send the crafted payload to the target endpoint via HTTP POST or the applicable transport protocol:

   POST /api/msgpack HTTP/1.1
   Content-Type: application/x-msgpack
   Content-Length: 12
   \x92\xdf\x40\x00\x00\x00\xa5pwned

4. Observe desynchronization: The server calls unpackArrayHeader() (reads fixarray[2]), then skipValue() on the MAP32. The integer overflow causes skipValue() to return immediately without consuming the map body.
5. Inject data: The subsequent unpackValue() call reads the attacker-supplied string ("pwned") instead of the expected next legitimate field, confirming that attacker-controlled data has been injected into the application's data processing pipeline (GitHub Issue).

• Network: Inbound HTTP POST requests (or other transport) to msgpack API endpoints with a Content-Type: application/x-msgpack header and a payload containing the byte sequence \xdf\x40\x00\x00\x00 (MAP32 format byte followed by element count 0x40000000).
• Network: Unusually short msgpack payloads (as few as 12 bytes) sent to endpoints that normally receive larger, well-formed messages.
• Logs: Application logs showing unexpected field values or type mismatches in fields that follow map-type structures, potentially indicating parser desynchronization.
• Logs: Java exceptions or unexpected behavior in message processing code immediately after a skipValue() call on a MAP32 container.
• File System / Process: No specific file system or process artifacts are expected, as this is a data-injection attack that operates entirely within the message parsing layer (GitHub Issue).

Upgrade msgpack-java to a version after 0.9.12 that includes the integer overflow fix once a patched release is published. As a workaround, implement input validation at the application layer to reject msgpack messages containing MAP32 containers with element counts at or above 0x40000000 before passing them to MessageUnpacker. Additionally, consider enforcing message size limits and timeouts on unpacking operations. The recommended code-level fix is to use overflow-safe arithmetic in the MAP32 (and ARRAY32) branch of skipValue(), using Math.multiplyExact() with long arithmetic and throwing a MessageSizeException on overflow, as described in the original disclosure (GitHub Issue, Github Advisory).