CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48506

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing the reader depth or calling the configured depth checks. This bypasses MessagePackSecurity.MaximumObjectGraphDepth, the library's documented protection against deeply nested object graphs. Many generated and dynamic formatters call reader.Skip() when they encounter unknown map keys, unknown array members, ignored fields, or data that should be skipped for forward compatibility. A deeply nested value in one of these skipped positions can therefore cause unbounded recursion and an uncatchable StackOverflowException. This vulnerability is fixed in 2.5.301 and 3.1.7.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 20.8%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-vh6j-jc39-fggf

Products affected by CVE-2026-48506

Messagepack » Messagepack » Version: .1.7.3.5

cpe:2.3:a:messagepack:messagepack:.1.7.3.5
Messagepack » Messagepack » Version: .1.7.3.6

cpe:2.3:a:messagepack:messagepack:.1.7.3.6
Messagepack » Messagepack » Version: 1.0.1

cpe:2.3:a:messagepack:messagepack:1.0.1
Messagepack » Messagepack » Version: 1.0.2

cpe:2.3:a:messagepack:messagepack:1.0.2
Messagepack » Messagepack » Version: 1.0.3

cpe:2.3:a:messagepack:messagepack:1.0.3
Messagepack » Messagepack » Version: 1.1.0

cpe:2.3:a:messagepack:messagepack:1.1.0
Messagepack » Messagepack » Version: 1.1.1

cpe:2.3:a:messagepack:messagepack:1.1.1
Messagepack » Messagepack » Version: 1.1.2

cpe:2.3:a:messagepack:messagepack:1.1.2
Messagepack » Messagepack » Version: 1.2.0

cpe:2.3:a:messagepack:messagepack:1.2.0
Messagepack » Messagepack » Version: 1.2.1

cpe:2.3:a:messagepack:messagepack:1.2.1
Messagepack » Messagepack » Version: 1.2.3

cpe:2.3:a:messagepack:messagepack:1.2.3
Messagepack » Messagepack » Version: 1.3.0

cpe:2.3:a:messagepack:messagepack:1.3.0
Messagepack » Messagepack » Version: 1.3.1

cpe:2.3:a:messagepack:messagepack:1.3.1
Messagepack » Messagepack » Version: 1.3.2

cpe:2.3:a:messagepack:messagepack:1.3.2
Messagepack » Messagepack » Version: 1.3.3

cpe:2.3:a:messagepack:messagepack:1.3.3
Messagepack » Messagepack » Version: 1.4.0

cpe:2.3:a:messagepack:messagepack:1.4.0
Messagepack » Messagepack » Version: 1.4.1

cpe:2.3:a:messagepack:messagepack:1.4.1
Messagepack » Messagepack » Version: 1.4.2

cpe:2.3:a:messagepack:messagepack:1.4.2
Messagepack » Messagepack » Version: 1.4.3

cpe:2.3:a:messagepack:messagepack:1.4.3
Messagepack » Messagepack » Version: 1.4.4

cpe:2.3:a:messagepack:messagepack:1.4.4
Messagepack » Messagepack » Version: 1.5.0

cpe:2.3:a:messagepack:messagepack:1.5.0
Messagepack » Messagepack » Version: 1.5.1

cpe:2.3:a:messagepack:messagepack:1.5.1
Messagepack » Messagepack » Version: 1.6.0

cpe:2.3:a:messagepack:messagepack:1.6.0
Messagepack » Messagepack » Version: 1.6.1

cpe:2.3:a:messagepack:messagepack:1.6.1
Messagepack » Messagepack » Version: 1.6.1.2

cpe:2.3:a:messagepack:messagepack:1.6.1.2
Messagepack » Messagepack » Version: 1.6.2

cpe:2.3:a:messagepack:messagepack:1.6.2
Messagepack » Messagepack » Version: 1.7.0

cpe:2.3:a:messagepack:messagepack:1.7.0
Messagepack » Messagepack » Version: 1.7.1

cpe:2.3:a:messagepack:messagepack:1.7.1
Messagepack » Messagepack » Version: 1.7.2

cpe:2.3:a:messagepack:messagepack:1.7.2
Messagepack » Messagepack » Version: 1.7.3

cpe:2.3:a:messagepack:messagepack:1.7.3
Messagepack » Messagepack » Version: 1.7.3.1

cpe:2.3:a:messagepack:messagepack:1.7.3.1
Messagepack » Messagepack » Version: 1.7.3.2

cpe:2.3:a:messagepack:messagepack:1.7.3.2
Messagepack » Messagepack » Version: 1.7.3.3

cpe:2.3:a:messagepack:messagepack:1.7.3.3
Messagepack » Messagepack » Version: 1.7.3.4

cpe:2.3:a:messagepack:messagepack:1.7.3.4
Messagepack » Messagepack » Version: 1.7.3.7

cpe:2.3:a:messagepack:messagepack:1.7.3.7
Messagepack » Messagepack » Version: 1.9.3

cpe:2.3:a:messagepack:messagepack:1.9.3
Messagepack » Messagepack » Version: 2.0.110

cpe:2.3:a:messagepack:messagepack:2.0.110
Messagepack » Messagepack » Version: 2.0.119

cpe:2.3:a:messagepack:messagepack:2.0.119
Messagepack » Messagepack » Version: 2.0.123

cpe:2.3:a:messagepack:messagepack:2.0.123
Messagepack » Messagepack » Version: 2.0.204

cpe:2.3:a:messagepack:messagepack:2.0.204
Messagepack » Messagepack » Version: 2.0.270

cpe:2.3:a:messagepack:messagepack:2.0.270
Messagepack » Messagepack » Version: 2.0.299

cpe:2.3:a:messagepack:messagepack:2.0.299
Messagepack » Messagepack » Version: 2.0.323

cpe:2.3:a:messagepack:messagepack:2.0.323
Messagepack » Messagepack » Version: 2.0.335

cpe:2.3:a:messagepack:messagepack:2.0.335
Messagepack » Messagepack » Version: 2.0.94

cpe:2.3:a:messagepack:messagepack:2.0.94
Messagepack » Messagepack » Version: 2.1.115

cpe:2.3:a:messagepack:messagepack:2.1.115
Messagepack » Messagepack » Version: 2.1.143

cpe:2.3:a:messagepack:messagepack:2.1.143
Messagepack » Messagepack » Version: 2.1.152

cpe:2.3:a:messagepack:messagepack:2.1.152
Messagepack » Messagepack » Version: 2.1.165

cpe:2.3:a:messagepack:messagepack:2.1.165
Messagepack » Messagepack » Version: 2.1.194

cpe:2.3:a:messagepack:messagepack:2.1.194
Messagepack » Messagepack » Version: 2.1.80

cpe:2.3:a:messagepack:messagepack:2.1.80
Messagepack » Messagepack » Version: 2.1.90

cpe:2.3:a:messagepack:messagepack:2.1.90
Messagepack » Messagepack » Version: 2.2.113

cpe:2.3:a:messagepack:messagepack:2.2.113
Messagepack » Messagepack » Version: 2.2.36

cpe:2.3:a:messagepack:messagepack:2.2.36
Messagepack » Messagepack » Version: 2.2.44

cpe:2.3:a:messagepack:messagepack:2.2.44
Messagepack » Messagepack » Version: 2.2.60

cpe:2.3:a:messagepack:messagepack:2.2.60
Messagepack » Messagepack » Version: 2.2.85

cpe:2.3:a:messagepack:messagepack:2.2.85
Messagepack » Messagepack » Version: 2.3.112

cpe:2.3:a:messagepack:messagepack:2.3.112
Messagepack » Messagepack » Version: 2.3.58

cpe:2.3:a:messagepack:messagepack:2.3.58
Messagepack » Messagepack » Version: 2.3.73

cpe:2.3:a:messagepack:messagepack:2.3.73
Messagepack » Messagepack » Version: 2.3.75

cpe:2.3:a:messagepack:messagepack:2.3.75
Messagepack » Messagepack » Version: 2.3.85

cpe:2.3:a:messagepack:messagepack:2.3.85
Messagepack » Messagepack » Version: 2.4.14

cpe:2.3:a:messagepack:messagepack:2.4.14
Messagepack » Messagepack » Version: 2.4.23

cpe:2.3:a:messagepack:messagepack:2.4.23
Messagepack » Messagepack » Version: 2.4.35

cpe:2.3:a:messagepack:messagepack:2.4.35
Messagepack » Messagepack » Version: 2.4.59

cpe:2.3:a:messagepack:messagepack:2.4.59
Messagepack » Messagepack » Version: 2.5.103

cpe:2.3:a:messagepack:messagepack:2.5.103
Messagepack » Messagepack » Version: 2.5.108

cpe:2.3:a:messagepack:messagepack:2.5.108
Messagepack » Messagepack » Version: 2.5.124

cpe:2.3:a:messagepack:messagepack:2.5.124
Messagepack » Messagepack » Version: 2.5.129

cpe:2.3:a:messagepack:messagepack:2.5.129
Messagepack » Messagepack » Version: 2.5.140

cpe:2.3:a:messagepack:messagepack:2.5.140
Messagepack » Messagepack » Version: 2.5.168

cpe:2.3:a:messagepack:messagepack:2.5.168
Messagepack » Messagepack » Version: 2.5.171

cpe:2.3:a:messagepack:messagepack:2.5.171
Messagepack » Messagepack » Version: 2.5.172

cpe:2.3:a:messagepack:messagepack:2.5.172
Messagepack » Messagepack » Version: 2.5.187

cpe:2.3:a:messagepack:messagepack:2.5.187
Messagepack » Messagepack » Version: 2.5.192

cpe:2.3:a:messagepack:messagepack:2.5.192
Messagepack » Messagepack » Version: 2.5.198

cpe:2.3:a:messagepack:messagepack:2.5.198
Messagepack » Messagepack » Version: 2.5.205

cpe:2.3:a:messagepack:messagepack:2.5.205
Messagepack » Messagepack » Version: 2.5.64

cpe:2.3:a:messagepack:messagepack:2.5.64
Messagepack » Messagepack » Version: 2.5.94

cpe:2.3:a:messagepack:messagepack:2.5.94
Messagepack » Messagepack » Version: 3.0.111

cpe:2.3:a:messagepack:messagepack:3.0.111
Messagepack » Messagepack » Version: 3.0.129

cpe:2.3:a:messagepack:messagepack:3.0.129
Messagepack » Messagepack » Version: 3.0.134

cpe:2.3:a:messagepack:messagepack:3.0.134
Messagepack » Messagepack » Version: 3.0.208

cpe:2.3:a:messagepack:messagepack:3.0.208
Messagepack » Messagepack » Version: 3.0.214

cpe:2.3:a:messagepack:messagepack:3.0.214
Messagepack » Messagepack » Version: 3.0.233

cpe:2.3:a:messagepack:messagepack:3.0.233
Messagepack » Messagepack » Version: 3.0.238

cpe:2.3:a:messagepack:messagepack:3.0.238
Messagepack » Messagepack » Version: 3.0.3

cpe:2.3:a:messagepack:messagepack:3.0.3
Messagepack » Messagepack » Version: 3.0.300

cpe:2.3:a:messagepack:messagepack:3.0.300
Messagepack » Messagepack » Version: 3.0.301

cpe:2.3:a:messagepack:messagepack:3.0.301
Messagepack » Messagepack » Version: 3.0.54

cpe:2.3:a:messagepack:messagepack:3.0.54
Messagepack » Messagepack » Version: 3.1.0

cpe:2.3:a:messagepack:messagepack:3.1.0
Messagepack » Messagepack » Version: 3.1.1

cpe:2.3:a:messagepack:messagepack:3.1.1
Messagepack » Messagepack » Version: 3.1.2

cpe:2.3:a:messagepack:messagepack:3.1.2
Messagepack » Messagepack » Version: 3.1.3

cpe:2.3:a:messagepack:messagepack:3.1.3
Messagepack » Messagepack » Version: 3.1.4

cpe:2.3:a:messagepack:messagepack:3.1.4
Messagepack » Messagepack » Version: 3.1.5

cpe:2.3:a:messagepack:messagepack:3.1.5
Messagepack » Messagepack » Version: 3.1.6

cpe:2.3:a:messagepack:messagepack:3.1.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48506

Products

Pricing

Contact Us