By vendor

Messagepack vulnerabilities

Known CVEs affecting Messagepack products, prioritized by severity, with SEC.co remediation and detection guidance.

11 published vulnerabilities

• CVE-2026-48109HIGH 8.2

  MessagePack for C# contains a flaw in its optional LZ4 decompression feature that allows attackers to craft specially designed messages triggering buffer over-reads. When a vulnerable application receives and decompresses one of these malicious payloads, it can crash with an AccessViolationException, knocking the service offline. In some cases, the over-read may leak small amounts of adjacent memory before the crash occurs. Applications using MessagePack's Lz4Block or Lz4BlockArray compression modes are at risk if they process untrusted or network-sourced MessagePack data.

• CVE-2026-48502HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a critical memory management vulnerability in the timestamp parsing logic. When processing specially crafted MessagePack messages, the library allocates stack memory based on attacker-supplied values without first validating those values are legitimate. This can trigger a stack overflow that crashes the entire application with no opportunity for error handling. An attacker can exploit this remotely with a tiny payload to take down services using vulnerable versions of the library.

• CVE-2026-48506HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in the TrySkip() function that allows deeply nested data structures to bypass the library's built-in depth-checking protection. When the serializer encounters data it needs to skip—such as unknown fields or unrecognized map keys—it recursively processes nested structures without respecting the configured maximum object graph depth limit. An attacker who sends a specially crafted MessagePack payload with extreme nesting can trigger an unrecoverable stack overflow, causing the application to crash. This is a denial-of-service vulnerability affecting any .NET application using vulnerable versions of MessagePack.

• CVE-2026-48510HIGH 7.5

  MessagePack for C# has a denial-of-service vulnerability in how it handles compressed data. When decompressing LZ4-compressed payloads, the library allocates memory based on a size value claimed by the incoming data before checking whether that claim is legitimate. An attacker can send a small malicious file that declares itself to be enormous, forcing the application to reserve huge amounts of memory. This exhausts system resources and crashes the service. The flaw affects versions before 2.5.301 and 3.1.7, and patches are now available.

• CVE-2026-48511HIGH 7.5

  MessagePack for C# contains a performance vulnerability in its ExpandoObject deserialization handler. When deserializing untrusted data containing large maps with many distinct keys, the library exhibits quadratic behavior—CPU and memory usage grow exponentially rather than linearly with input size. An attacker sending a specially crafted MessagePack message can trigger excessive resource consumption, potentially causing denial of service. The flaw affects versions before 2.5.301 and 3.1.7.

• CVE-2026-48512HIGH 7.5

  MessagePack for C# contains multiple unguarded recursion paths in its JSON conversion helpers that allow attackers to trigger stack exhaustion. When processing nested JSON structures or even malformed JSON with repeated separators, the library fails to enforce depth limits consistently, leading to an uncatchable StackOverflowException that crashes the process. This is a denial-of-service vulnerability affecting applications that use MessagePack to deserialize or convert JSON from untrusted sources.

• CVE-2026-48513HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in how they deserialize union types—a common pattern for handling multiple possible data structures. When processing union data, the library fails to enforce recursion depth limits that normally prevent attackers from sending deeply nested objects that exhaust memory and crash applications. An attacker can send specially crafted MessagePack data with unknown union keys that bypasses these safety checks entirely, leading to denial of service.

• CVE-2026-48514HIGH 7.5

  MessagePack for C# contains a vulnerability in its deserialization logic that allows an attacker to trigger excessive memory allocation with minimal network traffic. When deserializing specially crafted MessagePack data, the library reads a size value from the data stream and allocates memory for an array without properly validating that the claimed size matches the actual available data. An attacker can send a tiny payload claiming to contain a massive array, forcing the application to allocate gigabytes of RAM—potentially exhausting system resources and causing the application to crash.

• CVE-2026-48515HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a denial-of-service vulnerability in how they deserialize multi-dimensional arrays. When processing serialized data, the library allocates memory for arrays based on dimension sizes claimed in the payload before checking whether those dimensions are consistent with the actual array data. An attacker can craft a small malicious message that declares enormous array dimensions, triggering a massive memory allocation on the target system even though the message contains little actual data. This causes the application to consume excessive heap memory and can crash the service.

• CVE-2026-48516HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw that bypasses security protections when deserializing untrusted data. The vulnerability allows attackers to craft specially designed input that causes excessive CPU usage, effectively freezing or slowing an application—a denial-of-service condition. Even applications that have explicitly enabled security-hardened settings to handle untrusted input remain vulnerable because the library fails to apply the configured security rules in one specific code path.

• CVE-2026-48517HIGH 7.5

  MessagePack for C# contains a type-filtering bypass vulnerability in its typeless deserialization mechanism. The library implements a safety check to block dangerous types from being deserialized, but this check only examines the outermost type. An attacker can circumvent this protection by wrapping a blocked type inside an array or generic type wrapper, allowing the forbidden type to slip through validation and be instantiated anyway. This creates a deserialization attack surface that the vendor intended to close.