CyberRota Analysis
AI-GeneratedThe msgpack-java library versions up to 0.9.12 are vulnerable to an integer overflow in the MessageUnpacker.skipValue() method, specifically when handling MAP32 containers with large element counts. This vulnerability can lead to desynchronization of the parser cursor, allowing attackers to manipulate the data returned by the parser, potentially exposing sensitive information. Developers and organizations utilizing this library should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.