Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-90473 →
DEBIAN-CVE-2026-90473
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large elem...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
msgpack-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
msgpack-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
msgpack-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org