The 6-Byte JVM Killer: Deep Dive into CVE-2026-21452
Jan 5, 2026·6 min read·6 visits
Executive Summary (TL;DR)
MessagePack-Java (msgpack-java) versions before 0.9.11 blindly trust the declared length of incoming objects. By sending a malicious packet claiming to contain 2GB of data (while actually containing nothing), an attacker can trick the library into attempting a massive immediate memory allocation. This causes an OutOfMemoryError (OOM), crashing the JVM instantly. The fix involves a 'gradual loading' strategy for large objects.
A classic 'Allocation of Resources Without Limits' vulnerability in msgpack-java allows remote attackers to crash Java applications with a tiny, 6-byte payload that triggers massive heap allocations.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
msgpack-java MessagePack | < 0.9.11 | 0.9.11 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-789 |
| Attack Vector | Network |
| CVSS Score | 7.5 (High) |
| Exploit Status | POC Available |
| Impact | Denial of Service (OOM) |
| Fix Version | 0.9.11 |
MITRE ATT&CK Mapping
The product allocates memory based on an untrusted size value, allowing an attacker to cause a denial of service by consuming all available memory.