TI-2026-74662 CVE-2026-92707 · GHSA-qhrr-8q5h-9q3h
Nested arrays in MessagePack for C# cause excessive memory allocation
Priority LOW 31
MessagePack for C# is a MessagePack serializer for C#.
Vulnerabilities
15 records
TI-2026-35549 CVE-2026-48109 · GHSA-hv8m-jj95-wg3x
MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
Priority MEDIUM 42
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35863 CVE-2026-48502 · GHSA-382j-8mxh-c7x2
Out-of-bounds read in MessagePack-CSharp
Priority LOW 36
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35866 CVE-2026-48506 · GHSA-vh6j-jc39-fggf
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
Priority LOW 39
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35869 CVE-2026-48509 · GHSA-2f33-pr97-265q
MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35870 CVE-2026-48510 · GHSA-v72x-2h86-7f8m
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35871 CVE-2026-48511 · GHSA-2x83-8g95-xh59
MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35872 CVE-2026-48512 · GHSA-cj9g-3mj2-g8vv
MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35873 CVE-2026-48513 · GHSA-wfr3-xj75-pfwh
MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement
Priority LOW 36
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35874 CVE-2026-48514 · GHSA-w567-gjr2-hm5j
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35875 CVE-2026-48515 · GHSA-cxmj-83gh-fp49
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35876 CVE-2026-48516 · GHSA-q2h6-ghwm-5qm8
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2026-35877 CVE-2026-48517 · GHSA-qhmf-xw27-6rqr
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Priority LOW 28
MessagePack for C# is a MessagePack serializer for C#.
TI-2024-32619 CVE-2024-48924 · GHSA-4qm4-8hg2-g2xm
MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow
Priority MEDIUM 44
### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to…
TI-2020-04290 CVE-2020-5234 · GHSA-7q36-4xx7-xcxf
Untrusted data can lead to DoS attack in MessagePack for C# and Unity
Priority LOW 32
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow.