Messagepack vulnerabilities

Products

• Messagepack 13

Newest

• messagepack, messagepack-csharp +1 more MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows CVE-2026-48502 Fix available 8.2 HighJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVE-2026-48506 Fix available 7.5 HighJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies CVE-2026-48509 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths CVE-2026-48510 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps CVE-2026-48511 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement CVE-2026-48512 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVE-2026-48513 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length CVE-2026-48514 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions CVE-2026-48515 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings CVE-2026-48516 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVE-2026-48517 Fix available 6.3 MediumJune 22, 2026
• messagepack, messagepack-csharp +1 more MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVE-2026-48109 Fix available 8.2 HighJune 11, 2026
• messagepack messagepack-csharp MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow CVE-2024-48924 Fix available 8.7 HighOctober 17, 2024
• messagepack, neuecc messagepack.immutablecollection, messagepack.reactiveproperty +1 more +3 more Untrusted data can lead to DoS attack in MessagePack for C# and Unity CVE-2020-5234 Fix available 4.8 MediumJanuary 31, 2020