{"action":"Upgrade org.msgpack:msgpack-core to 0.9.11 or later.","affected":[{"fixed":"0.9.11","introduced":"0"}],"component":"org.msgpack:msgpack-core","cve_ids":["CVE-2026-21452"],"ecosystem":"Maven","epss":0.00602,"exploited":false,"fixed_versions":["0.9.11"],"ghsa_id":"GHSA-cw39-r4h6-8j3x","id":"tcs_01M5N8TDY18687RRZVM6YXMPXA","modified_at":"2026-09-10T03:50:32.939780126Z","published_at":"2026-01-05T14:59:12Z","references":["https://osv.dev/vulnerability/GHSA-cw39-r4h6-8j3x","https://github.com/msgpack/msgpack-java/security/advisories/GHSA-cw39-r4h6-8j3x","https://nvd.nist.gov/vuln/detail/CVE-2026-21452","https://github.com/msgpack/msgpack-java/commit/daa2ea6b2f11f500e22c70a22f689f7a9debdeae","https://github.com/msgpack/msgpack-java","https://github.com/msgpack/msgpack-java/releases/tag/v0.9.11"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cw39-r4h6-8j3x","url":"https://osv.dev/vulnerability/GHSA-cw39-r4h6-8j3x"}],"summary":"MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation"}