-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service in the msgpack-java library, caused by uncontrolled memory allocation. The root cause lies in the org.msgpack.core.MessageUnpacker.readPayload(int length) method. Prior to the patch, this method would immediately allocate a byte array of size length (new byte[length]), where length is a value read directly from the (potentially malicious) input stream's EXT32 or BIN32 header. An attacker could craft a very small file declaring a huge payload length (e.g., 1GB), causing the library to attempt a massive memory allocation that results in a java.lang.OutOfMemoryError, terminating the application.
The exploit is typically triggered through higher-level API calls like unpackValue() and ExtensionValue.getData(), which lead to the invocation of the vulnerable readPayload method, as confirmed by the stack trace in the vulnerability report. The patch resolves this by modifying readPayload to use a safer, gradual allocation strategy for payloads declaring a size over a 64MB threshold. It reads the data in chunks, verifying that the input stream actually contains the data before committing to the full memory allocation, thus preventing the DoS attack. The analysis identified both the root-cause function (readPayload) and the key library function in the exploit chain (unpackValue) as the vulnerable functions that would appear in a runtime profile.
org.msgpack.core.MessageUnpacker.readPayloadmsgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
org.msgpack.core.MessageUnpacker.unpackValuemsgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.msgpack:msgpack-core | maven | < 0.9.11 | 0.9.11 |