CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48109

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 21.1%

CVSS Severity

CVSS v3 Score 8.2

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-hv8m-jj95-wg3x

Products affected by CVE-2026-48109

Messagepack » Messagepack » Version: .1.7.3.5

cpe:2.3:a:messagepack:messagepack:.1.7.3.5
Messagepack » Messagepack » Version: .1.7.3.6

cpe:2.3:a:messagepack:messagepack:.1.7.3.6
Messagepack » Messagepack » Version: 1.0.1

cpe:2.3:a:messagepack:messagepack:1.0.1
Messagepack » Messagepack » Version: 1.0.2

cpe:2.3:a:messagepack:messagepack:1.0.2
Messagepack » Messagepack » Version: 1.0.3

cpe:2.3:a:messagepack:messagepack:1.0.3
Messagepack » Messagepack » Version: 1.1.0

cpe:2.3:a:messagepack:messagepack:1.1.0
Messagepack » Messagepack » Version: 1.1.1

cpe:2.3:a:messagepack:messagepack:1.1.1
Messagepack » Messagepack » Version: 1.1.2

cpe:2.3:a:messagepack:messagepack:1.1.2
Messagepack » Messagepack » Version: 1.2.0

cpe:2.3:a:messagepack:messagepack:1.2.0
Messagepack » Messagepack » Version: 1.2.1

cpe:2.3:a:messagepack:messagepack:1.2.1
Messagepack » Messagepack » Version: 1.2.3

cpe:2.3:a:messagepack:messagepack:1.2.3
Messagepack » Messagepack » Version: 1.3.0

cpe:2.3:a:messagepack:messagepack:1.3.0
Messagepack » Messagepack » Version: 1.3.1

cpe:2.3:a:messagepack:messagepack:1.3.1
Messagepack » Messagepack » Version: 1.3.2

cpe:2.3:a:messagepack:messagepack:1.3.2
Messagepack » Messagepack » Version: 1.3.3

cpe:2.3:a:messagepack:messagepack:1.3.3
Messagepack » Messagepack » Version: 1.4.0

cpe:2.3:a:messagepack:messagepack:1.4.0
Messagepack » Messagepack » Version: 1.4.1

cpe:2.3:a:messagepack:messagepack:1.4.1
Messagepack » Messagepack » Version: 1.4.2

cpe:2.3:a:messagepack:messagepack:1.4.2
Messagepack » Messagepack » Version: 1.4.3

cpe:2.3:a:messagepack:messagepack:1.4.3
Messagepack » Messagepack » Version: 1.4.4

cpe:2.3:a:messagepack:messagepack:1.4.4
Messagepack » Messagepack » Version: 1.5.0

cpe:2.3:a:messagepack:messagepack:1.5.0
Messagepack » Messagepack » Version: 1.5.1

cpe:2.3:a:messagepack:messagepack:1.5.1
Messagepack » Messagepack » Version: 1.6.0

cpe:2.3:a:messagepack:messagepack:1.6.0
Messagepack » Messagepack » Version: 1.6.1

cpe:2.3:a:messagepack:messagepack:1.6.1
Messagepack » Messagepack » Version: 1.6.1.2

cpe:2.3:a:messagepack:messagepack:1.6.1.2
Messagepack » Messagepack » Version: 1.6.2

cpe:2.3:a:messagepack:messagepack:1.6.2
Messagepack » Messagepack » Version: 1.7.0

cpe:2.3:a:messagepack:messagepack:1.7.0
Messagepack » Messagepack » Version: 1.7.1

cpe:2.3:a:messagepack:messagepack:1.7.1
Messagepack » Messagepack » Version: 1.7.2

cpe:2.3:a:messagepack:messagepack:1.7.2
Messagepack » Messagepack » Version: 1.7.3

cpe:2.3:a:messagepack:messagepack:1.7.3
Messagepack » Messagepack » Version: 1.7.3.1

cpe:2.3:a:messagepack:messagepack:1.7.3.1
Messagepack » Messagepack » Version: 1.7.3.2

cpe:2.3:a:messagepack:messagepack:1.7.3.2
Messagepack » Messagepack » Version: 1.7.3.3

cpe:2.3:a:messagepack:messagepack:1.7.3.3
Messagepack » Messagepack » Version: 1.7.3.4

cpe:2.3:a:messagepack:messagepack:1.7.3.4
Messagepack » Messagepack » Version: 1.7.3.7

cpe:2.3:a:messagepack:messagepack:1.7.3.7
Messagepack » Messagepack » Version: 1.9.3

cpe:2.3:a:messagepack:messagepack:1.9.3
Messagepack » Messagepack » Version: 2.0.110

cpe:2.3:a:messagepack:messagepack:2.0.110
Messagepack » Messagepack » Version: 2.0.119

cpe:2.3:a:messagepack:messagepack:2.0.119
Messagepack » Messagepack » Version: 2.0.123

cpe:2.3:a:messagepack:messagepack:2.0.123
Messagepack » Messagepack » Version: 2.0.204

cpe:2.3:a:messagepack:messagepack:2.0.204
Messagepack » Messagepack » Version: 2.0.270

cpe:2.3:a:messagepack:messagepack:2.0.270
Messagepack » Messagepack » Version: 2.0.299

cpe:2.3:a:messagepack:messagepack:2.0.299
Messagepack » Messagepack » Version: 2.0.323

cpe:2.3:a:messagepack:messagepack:2.0.323
Messagepack » Messagepack » Version: 2.0.335

cpe:2.3:a:messagepack:messagepack:2.0.335
Messagepack » Messagepack » Version: 2.0.94

cpe:2.3:a:messagepack:messagepack:2.0.94
Messagepack » Messagepack » Version: 2.1.115

cpe:2.3:a:messagepack:messagepack:2.1.115
Messagepack » Messagepack » Version: 2.1.143

cpe:2.3:a:messagepack:messagepack:2.1.143
Messagepack » Messagepack » Version: 2.1.152

cpe:2.3:a:messagepack:messagepack:2.1.152
Messagepack » Messagepack » Version: 2.1.165

cpe:2.3:a:messagepack:messagepack:2.1.165
Messagepack » Messagepack » Version: 2.1.194

cpe:2.3:a:messagepack:messagepack:2.1.194
Messagepack » Messagepack » Version: 2.1.80

cpe:2.3:a:messagepack:messagepack:2.1.80
Messagepack » Messagepack » Version: 2.1.90

cpe:2.3:a:messagepack:messagepack:2.1.90
Messagepack » Messagepack » Version: 2.2.113

cpe:2.3:a:messagepack:messagepack:2.2.113
Messagepack » Messagepack » Version: 2.2.36

cpe:2.3:a:messagepack:messagepack:2.2.36
Messagepack » Messagepack » Version: 2.2.44

cpe:2.3:a:messagepack:messagepack:2.2.44
Messagepack » Messagepack » Version: 2.2.60

cpe:2.3:a:messagepack:messagepack:2.2.60
Messagepack » Messagepack » Version: 2.2.85

cpe:2.3:a:messagepack:messagepack:2.2.85
Messagepack » Messagepack » Version: 2.3.112

cpe:2.3:a:messagepack:messagepack:2.3.112
Messagepack » Messagepack » Version: 2.3.58

cpe:2.3:a:messagepack:messagepack:2.3.58
Messagepack » Messagepack » Version: 2.3.73

cpe:2.3:a:messagepack:messagepack:2.3.73
Messagepack » Messagepack » Version: 2.3.75

cpe:2.3:a:messagepack:messagepack:2.3.75
Messagepack » Messagepack » Version: 2.3.85

cpe:2.3:a:messagepack:messagepack:2.3.85
Messagepack » Messagepack » Version: 2.4.14

cpe:2.3:a:messagepack:messagepack:2.4.14
Messagepack » Messagepack » Version: 2.4.23

cpe:2.3:a:messagepack:messagepack:2.4.23
Messagepack » Messagepack » Version: 2.4.35

cpe:2.3:a:messagepack:messagepack:2.4.35
Messagepack » Messagepack » Version: 2.4.59

cpe:2.3:a:messagepack:messagepack:2.4.59
Messagepack » Messagepack » Version: 2.5.103

cpe:2.3:a:messagepack:messagepack:2.5.103
Messagepack » Messagepack » Version: 2.5.108

cpe:2.3:a:messagepack:messagepack:2.5.108
Messagepack » Messagepack » Version: 2.5.124

cpe:2.3:a:messagepack:messagepack:2.5.124
Messagepack » Messagepack » Version: 2.5.129

cpe:2.3:a:messagepack:messagepack:2.5.129
Messagepack » Messagepack » Version: 2.5.140

cpe:2.3:a:messagepack:messagepack:2.5.140
Messagepack » Messagepack » Version: 2.5.168

cpe:2.3:a:messagepack:messagepack:2.5.168
Messagepack » Messagepack » Version: 2.5.171

cpe:2.3:a:messagepack:messagepack:2.5.171
Messagepack » Messagepack » Version: 2.5.172

cpe:2.3:a:messagepack:messagepack:2.5.172
Messagepack » Messagepack » Version: 2.5.187

cpe:2.3:a:messagepack:messagepack:2.5.187
Messagepack » Messagepack » Version: 2.5.192

cpe:2.3:a:messagepack:messagepack:2.5.192
Messagepack » Messagepack » Version: 2.5.198

cpe:2.3:a:messagepack:messagepack:2.5.198
Messagepack » Messagepack » Version: 2.5.205

cpe:2.3:a:messagepack:messagepack:2.5.205
Messagepack » Messagepack » Version: 2.5.64

cpe:2.3:a:messagepack:messagepack:2.5.64
Messagepack » Messagepack » Version: 2.5.94

cpe:2.3:a:messagepack:messagepack:2.5.94
Messagepack » Messagepack » Version: 3.0.111

cpe:2.3:a:messagepack:messagepack:3.0.111
Messagepack » Messagepack » Version: 3.0.129

cpe:2.3:a:messagepack:messagepack:3.0.129
Messagepack » Messagepack » Version: 3.0.134

cpe:2.3:a:messagepack:messagepack:3.0.134
Messagepack » Messagepack » Version: 3.0.208

cpe:2.3:a:messagepack:messagepack:3.0.208
Messagepack » Messagepack » Version: 3.0.214

cpe:2.3:a:messagepack:messagepack:3.0.214
Messagepack » Messagepack » Version: 3.0.233

cpe:2.3:a:messagepack:messagepack:3.0.233
Messagepack » Messagepack » Version: 3.0.238

cpe:2.3:a:messagepack:messagepack:3.0.238
Messagepack » Messagepack » Version: 3.0.3

cpe:2.3:a:messagepack:messagepack:3.0.3
Messagepack » Messagepack » Version: 3.0.300

cpe:2.3:a:messagepack:messagepack:3.0.300
Messagepack » Messagepack » Version: 3.0.301

cpe:2.3:a:messagepack:messagepack:3.0.301
Messagepack » Messagepack » Version: 3.0.54

cpe:2.3:a:messagepack:messagepack:3.0.54
Messagepack » Messagepack » Version: 3.1.0

cpe:2.3:a:messagepack:messagepack:3.1.0
Messagepack » Messagepack » Version: 3.1.1

cpe:2.3:a:messagepack:messagepack:3.1.1
Messagepack » Messagepack » Version: 3.1.2

cpe:2.3:a:messagepack:messagepack:3.1.2
Messagepack » Messagepack » Version: 3.1.3

cpe:2.3:a:messagepack:messagepack:3.1.3
Messagepack » Messagepack » Version: 3.1.4

cpe:2.3:a:messagepack:messagepack:3.1.4
Messagepack » Messagepack » Version: 3.1.5

cpe:2.3:a:messagepack:messagepack:3.1.5
Messagepack » Messagepack » Version: 3.1.6

cpe:2.3:a:messagepack:messagepack:3.1.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48109

Products

Pricing

Contact Us