{"data":{"id":"86ab30d1-1a04-4b40-91a6-e69ce0d27d14","title":"CVE-2026-21452: MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions…","summary":"MessagePack for Java versions prior to 0.9.11 are vulnerable to a denial-of-service flaw when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. When ExtensionValue.getData() is invoked, the library allocates a byte array of the declared length without an upper bound, so a file only a few bytes long can exhaust the JVM heap, terminate the process, or make the service unavailable.","solution":"Fixed in 0.9.11.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21452","publishedAt":"2026-01-02T21:16:03.067Z","cveId":"CVE-2026-21452","cweIds":["CWE-400","CWE-789"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["org.msgpack:msgpack-core@< 0.9.11 (fixed: 0.9.11)"],"affectedPackageNames":["org-msgpack:msgpack-core"],"affectedPackageRefs":["maven:org-msgpack:msgpack-core"],"affectedVendors":[],"affectedVendorsRaw":["MessagePack for Java"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MessagePack for Java denial of service via EXT32 payload length","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00602,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":["GHSA-cw39-r4h6-8j3x"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:30.110Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:42:12.018Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"org.msgpack:msgpack-core","fixedVersion":"0.9.11","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:42:11.869Z"}]}}