Wayde Shi

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

**Nome do Software Vulnerável e Versões Afetadas** Bouncy Castle for Java versões anteriores a 1.85 Bouncy Castle for Java LTS versões anteriores a 2.73.12 **Description** O keystore BKS/UBER aloca memória com base em comprimentos não confiáveis antes de realizar a verificação de integridade. Isso pode levar ao esgotamento de recursos ou instabilidade ao processar arquivos de keystore maliciosos. **Recommendations** Atualize o Bouncy Castle for Java para a versão 1.85 ou posterior. Atualize o Bouncy Castle for Java LTS para a versão 2.73.12 ou posterior.