MessagePack-CSharp vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202613

Newest CVEs

• CVE-2026-92707

  MessagePack: Nested arrays can blow past buffer length limits

  MessagePack-CSharp · MessagePack-CSharp

  Medium5.3
• CVE-2026-48109

  MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

  MessagePack-CSharp · MessagePack-CSharp

  High8.2
• CVE-2026-48502

  MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

  MessagePack-CSharp · MessagePack-CSharp

  High8.2
• CVE-2026-48506

  MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

  MessagePack-CSharp · MessagePack-CSharp

  High7.5
• CVE-2026-48509

  MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3
• CVE-2026-48510

  MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3
• CVE-2026-48511

  MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3
• CVE-2026-48512

  MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3
• CVE-2026-48513

  MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3
• CVE-2026-48514

  MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

  MessagePack-CSharp · MessagePack-CSharp

  Medium6.3