PatchTheCVE: messagepack

CVE-2026-48517: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 17:16:39 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type na

CVE-2026-48516: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 17:16:39 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter constructs an internal Dictionary> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqual

CVE-2026-48515: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 17:16:39 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element cou

CVE-2026-48514: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:36 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining

CVE-2026-48513: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:36 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means

CVE-2026-48512: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:36 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deser

CVE-2026-48511: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:35 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so ins

CVE-2026-48510: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:35 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed d

CVE-2026-48509: MessagePack for C# is a MessagePack serializer for C#

Thu, 25 Jun 2026 16:16:35 +0000

CRITICAL 9.1: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP

CVE-2026-48506: MessagePack for C# is a MessagePack serializer for C#

Tue, 23 Jun 2026 17:24:50 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing the reader depth or calling the configured depth checks. This bypasses MessagePackSecurity.MaximumObjectGraphDepth, the

CVE-2026-48502: MessagePack for C# is a MessagePack serializer for C#

Tue, 23 Jun 2026 17:25:05 +0000

HIGH 7.5: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension

CVE-2026-48109: MessagePack for C# is a MessagePack serializer for C#

Tue, 23 Jun 2026 17:25:43 +0000

HIGH 8.2: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that doe