GHSA-cw39-r4h6-8j3x
High · 7.5CVSS
7.5
EPSS
—
Published
Jan 5, 2026
CISA due date
—
The record
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.msgpack:msgpack-core | 0 | 0.9.11 |
| Chainguard | camunda-8.8 | 0 | 8.8.9-r0 |
| Chainguard | camunda-8.8-compat | 0 | 8.8.8-r0 |
| Chainguard | camunda-zeebe-8.3 | 0 | 8.3.22-r12 |
| Chainguard | camunda-zeebe-8.3-compat | 0 | 8.3.22-r12 |
| Chainguard | camunda-zeebe-8.4 | 0 | 8.4.21-r11 |
| Chainguard | camunda-zeebe-8.4-compat | 0 | 8.4.21-r11 |
| Chainguard | camunda-zeebe-8.5 | 0 | 8.5.25-r4 |
| Chainguard | camunda-zeebe-8.5-compat | 0 | 8.5.25-r4 |
| Chainguard | camunda-zeebe-8.6 | 0 | 8.6.35-r1 |
| Chainguard | camunda-zeebe-8.6-compat | 0 | 8.6.34-r2 |
| Chainguard | camunda-zeebe-8.6-compat | 0 | 8.6.35-r1 |
| Chainguard | camunda-zeebe-8.7 | 0 | 8.7.22-r1 |
| Chainguard | camunda-zeebe-8.7-compat | 0 | 8.7.21-r2 |
| Chainguard | camunda-zeebe-8.8 | 0 | 8.8.8-r3 |
| Chainguard | camunda-zeebe-8.8 | 0 | 8.8.9-r1 |
| Chainguard | camunda-zeebe-8.8-compat | 0 | 8.8.8-r3 |
Related vulnerabilities
- CVE-2026-21452 MessagePack for Java is a serializer implementation for Java. Same vulnerability
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects camunda-8.8-compat
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects camunda-zeebe-8.3
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects camunda-zeebe-8.3
- CVE-2025-8916 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects camunda-zeebe-8.3
- CVE-2025-22227 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks… Also affects camunda-zeebe-8.3
- CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs Also affects camunda-zeebe-8.3
- CVE-2025-41249 The Spring Framework annotation detection mechanism may not correctly resolve annotations… Also affects camunda-zeebe-8.3-compat