Vulnerabilities

TI-2026-35549 CVE-2026-48109 · GHSA-hv8m-jj95-wg3x

MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

MEDIUM 42

MessagePack for C# is a MessagePack serializer for C#.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00509 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-20

TI-2026-35863 CVE-2026-48502 · GHSA-382j-8mxh-c7x2

Out-of-bounds read in MessagePack-CSharp

LOW 36

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00437 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-1188

TI-2026-35866 CVE-2026-48506 · GHSA-vh6j-jc39-fggf

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

LOW 39

MessagePack for C# is a MessagePack serializer for C#.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00471 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-674

TI-2026-35869 CVE-2026-48509 · GHSA-2f33-pr97-265q

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00416 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-1188

TI-2026-35870 CVE-2026-48510 · GHSA-v72x-2h86-7f8m

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-409

TI-2026-35871 CVE-2026-48511 · GHSA-2x83-8g95-xh59

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-407

TI-2026-35872 CVE-2026-48512 · GHSA-cj9g-3mj2-g8vv

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-674

TI-2026-35873 CVE-2026-48513 · GHSA-wfr3-xj75-pfwh

MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement

LOW 36

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-674

TI-2026-35874 CVE-2026-48514 · GHSA-w567-gjr2-hm5j

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-770

TI-2026-35875 CVE-2026-48515 · GHSA-cxmj-83gh-fp49

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-770

TI-2026-35876 CVE-2026-48516 · GHSA-q2h6-ghwm-5qm8

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00405 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-407

TI-2026-35877 CVE-2026-48517 · GHSA-qhmf-xw27-6rqr

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

LOW 28

MessagePack for C# is a MessagePack serializer for C#.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00348 Published 2026-06-22 Fixed in 3.1.7, 2.5.301 CWE-470

TI-2020-04290 CVE-2020-5234 · GHSA-7q36-4xx7-xcxf

Untrusted data can lead to DoS attack in MessagePack for C# and Unity

LOW 32

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01578 Published 2020-01-31 Fixed in 1.9.11, 2.1.90 CWE-121

Vulnerabilities

Filters