Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

MessagePack

15 known vulnerabilities (4 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 4 high, 11 medium
Registry
NuGet

Advisories 15

  • CVE-2026-92707Medium 5.3

    MessagePack: Nested arrays can blow past buffer length limits

    Affected: fixed in 2.5.303; from 3.0.0, fixed in 3.1.9.

  • MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

    Affected: fixed in 2.5.301; from 3.0.214-rc.1, fixed in 3.1.7.

  • MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

    Affected: from 3.0, fixed in 3.1.7.

  • MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48509Medium 6.3

    MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48510Medium 6.3

    MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48511Medium 6.3

    MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48512Medium 6.3

    MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48513Medium 6.3

    MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48514Medium 6.3

    MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48515Medium 6.3

    MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48516Medium 6.3

    MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • CVE-2026-48517Medium 6.3

    MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

    Affected: fixed in 2.5.301; from 3.0, fixed in 3.1.7.

  • MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow

    Affected: fixed in 2.5.187; from 2.6.95-alpha, fixed in 3.0.214-rc.1.

  • CVE-2020-5234Medium 4.8

    Untrusted data can lead to DoS attack in MessagePack for C# and Unity

    Affected: fixed in 1.9.11; from 2.0.0, fixed in 2.1.90.