Listen to this Post
The vulnerability exploits the EXT32 data type in the MessagePack serialization format. An attacker creates a small, syntactically valid .msgpack file where the EXT32 header declares an extremely large payload length (e.g., 470,000,001 bytes) but includes only a minimal actual payload. During deserialization with vulnerable versions of msgpack-java, the library’s `MessageUnpacker` parses this header lazily. The critical flaw occurs when `ExtensionValue.getData()` is invoked to materialize the extension object. The method blindly trusts the attacker-controlled length from the file header and attempts to allocate a single, contiguous byte array of that declared size via readPayload(). This triggers massive, unbounded heap memory allocation. On a Java Virtual Machine with limited heap, this immediately causes an OutOfMemoryError, leading to process termination and a complete denial of service. The attack is effective because the malicious file is tiny and valid, easily bypassing simple file checks, and can be triggered remotely via common model loading or data deserialization endpoints.
Platform: MessagePack Java
Version: 0.9.0-0.9.10
Vulnerability: Unbounded Memory Allocation
Severity: Critical
Date: 2026-01-05
Prediction: 2026-01-19
What Undercode Say
Bash Commands & Code
curl -LO https://repo1.maven.org/maven2/org/msgpack/msgpack-core/0.9.8/msgpack-core-0.9.8.jar
java -Xmx256m -cp .:msgpack-core-0.9.8.jar Main
header = b'\xC9' + struct.pack(">I", length) + b'\x01'
How Exploit
An attacker crafts an EXT32 bomb file. The file structure is a 0xC9 type byte, followed by a 4-byte big-endian integer defining a massive length (e.g., >256MB), and a single byte of actual payload. When a vulnerable Java application loads and deserializes this file, calling `getData()` on the extracted `ExtensionValue` object triggers the vulnerability. The JVM attempts to allocate memory for the declared size, exhausting the heap.
Protection from this CVE
Upgrade to msgpack-java version 0.9.11 or later, which contains the fix (commit daa2ea6). The patch implements gradual memory allocation for large payloads (>64MB) in the `readPayload(int)` method, preventing a single large allocation. Additionally, implement strict validation and size limits on incoming .msgpack files before deserialization in application code.
Impact
Remote Denial-of-Service. A small, malicious file can cause JVM heap exhaustion and crash when deserialized. This affects any service using vulnerable msgpack-java to load untrusted model files (e.g., from Hugging Face), model registries, or inference endpoints, leading to service unavailability and potential system failure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
