The flaw resides in the unpacking routine of msgpack-java, where nested arrays and maps are processed recursively without any depth enforcement. An attacker can craft MessagePack data that contains a vast number of nested levels, causing the unpacking thread’s call stack to overflow and raise a StackOverflowError. The failure occurs for the request that triggers the overflow and may cascade to other requests if the same thread is later reused, thereby denying service to legitimate users.

Applications that depend on msgpack-java version 0.9.12 or earlier are vulnerable. The library is a Java dependency used for serializing and deserializing structured data and is widely integrated into Java-based services that consume MessagePack payloads.

The CVSS score of 6.9 signals a moderate impact. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known production exploits yet to any endpoint that accepts external MessagePack input. No privileged access or code execution is required; simply delivering a the stack overflow and produce a denial-of-service condition.