CVE-2026-21452

CVE-2026-21452 is a denial-of-service vulnerability in MessagePack for Java versions prior to 0.9.11. It allows remote attackers to trigger unbounded heap allocation by providing a specially crafted .msgpack file containing an EXT32 object with an excessively large payload length. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a severe impact, as it can lead to JVM heap exhaustion, process termination, and service unavailability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the attack requires no user interaction or elevated privileges, making it a significant threat to applications deserializing untrusted .msgpack files.