Messagepack - vulnerabilities (CVEs)

14 CVEs in 2 products, 0 in the last 30 days, newest from 2026-06-22.

Products

• Messagepack - 13 CVEs
• Messagepack-csharp - 1 CVEs

Newest CVEs of Messagepack

• CVE-2026-48109 - CVSS 8.2 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by…
• CVE-2026-48502 - CVSS 8.2 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an…
• CVE-2026-48506 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and…
• CVE-2026-48509 - CVSS 9.1 (critical), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default…
• CVE-2026-48510 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it…
• CVE-2026-48511 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject…
• CVE-2026-48512 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion…
• CVE-2026-48513 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do…
• CVE-2026-48514 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled…
• CVE-2026-48515 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension…
• CVE-2026-48516 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal…
• CVE-2026-48517 - CVSS 7.5 (high), 2026-06-22: MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes…
• CVE-2024-48924 - CVSS 8.7 (high), 2024-10-17: ### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker…
• CVE-2020-5234 - CVSS 6.5 (medium), 2020-01-31: MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack…