CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48517

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 19.2%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhmf-xw27-6rqr

Products affected by CVE-2026-48517

Messagepack » Messagepack » Version: .1.7.3.5

cpe:2.3:a:messagepack:messagepack:.1.7.3.5
Messagepack » Messagepack » Version: .1.7.3.6

cpe:2.3:a:messagepack:messagepack:.1.7.3.6
Messagepack » Messagepack » Version: 1.0.1

cpe:2.3:a:messagepack:messagepack:1.0.1
Messagepack » Messagepack » Version: 1.0.2

cpe:2.3:a:messagepack:messagepack:1.0.2
Messagepack » Messagepack » Version: 1.0.3

cpe:2.3:a:messagepack:messagepack:1.0.3
Messagepack » Messagepack » Version: 1.1.0

cpe:2.3:a:messagepack:messagepack:1.1.0
Messagepack » Messagepack » Version: 1.1.1

cpe:2.3:a:messagepack:messagepack:1.1.1
Messagepack » Messagepack » Version: 1.1.2

cpe:2.3:a:messagepack:messagepack:1.1.2
Messagepack » Messagepack » Version: 1.2.0

cpe:2.3:a:messagepack:messagepack:1.2.0
Messagepack » Messagepack » Version: 1.2.1

cpe:2.3:a:messagepack:messagepack:1.2.1
Messagepack » Messagepack » Version: 1.2.3

cpe:2.3:a:messagepack:messagepack:1.2.3
Messagepack » Messagepack » Version: 1.3.0

cpe:2.3:a:messagepack:messagepack:1.3.0
Messagepack » Messagepack » Version: 1.3.1

cpe:2.3:a:messagepack:messagepack:1.3.1
Messagepack » Messagepack » Version: 1.3.2

cpe:2.3:a:messagepack:messagepack:1.3.2
Messagepack » Messagepack » Version: 1.3.3

cpe:2.3:a:messagepack:messagepack:1.3.3
Messagepack » Messagepack » Version: 1.4.0

cpe:2.3:a:messagepack:messagepack:1.4.0
Messagepack » Messagepack » Version: 1.4.1

cpe:2.3:a:messagepack:messagepack:1.4.1
Messagepack » Messagepack » Version: 1.4.2

cpe:2.3:a:messagepack:messagepack:1.4.2
Messagepack » Messagepack » Version: 1.4.3

cpe:2.3:a:messagepack:messagepack:1.4.3
Messagepack » Messagepack » Version: 1.4.4

cpe:2.3:a:messagepack:messagepack:1.4.4
Messagepack » Messagepack » Version: 1.5.0

cpe:2.3:a:messagepack:messagepack:1.5.0
Messagepack » Messagepack » Version: 1.5.1

cpe:2.3:a:messagepack:messagepack:1.5.1
Messagepack » Messagepack » Version: 1.6.0

cpe:2.3:a:messagepack:messagepack:1.6.0
Messagepack » Messagepack » Version: 1.6.1

cpe:2.3:a:messagepack:messagepack:1.6.1
Messagepack » Messagepack » Version: 1.6.1.2

cpe:2.3:a:messagepack:messagepack:1.6.1.2
Messagepack » Messagepack » Version: 1.6.2

cpe:2.3:a:messagepack:messagepack:1.6.2
Messagepack » Messagepack » Version: 1.7.0

cpe:2.3:a:messagepack:messagepack:1.7.0
Messagepack » Messagepack » Version: 1.7.1

cpe:2.3:a:messagepack:messagepack:1.7.1
Messagepack » Messagepack » Version: 1.7.2

cpe:2.3:a:messagepack:messagepack:1.7.2
Messagepack » Messagepack » Version: 1.7.3

cpe:2.3:a:messagepack:messagepack:1.7.3
Messagepack » Messagepack » Version: 1.7.3.1

cpe:2.3:a:messagepack:messagepack:1.7.3.1
Messagepack » Messagepack » Version: 1.7.3.2

cpe:2.3:a:messagepack:messagepack:1.7.3.2
Messagepack » Messagepack » Version: 1.7.3.3

cpe:2.3:a:messagepack:messagepack:1.7.3.3
Messagepack » Messagepack » Version: 1.7.3.4

cpe:2.3:a:messagepack:messagepack:1.7.3.4
Messagepack » Messagepack » Version: 1.7.3.7

cpe:2.3:a:messagepack:messagepack:1.7.3.7
Messagepack » Messagepack » Version: 1.9.3

cpe:2.3:a:messagepack:messagepack:1.9.3
Messagepack » Messagepack » Version: 2.0.110

cpe:2.3:a:messagepack:messagepack:2.0.110
Messagepack » Messagepack » Version: 2.0.119

cpe:2.3:a:messagepack:messagepack:2.0.119
Messagepack » Messagepack » Version: 2.0.123

cpe:2.3:a:messagepack:messagepack:2.0.123
Messagepack » Messagepack » Version: 2.0.204

cpe:2.3:a:messagepack:messagepack:2.0.204
Messagepack » Messagepack » Version: 2.0.270

cpe:2.3:a:messagepack:messagepack:2.0.270
Messagepack » Messagepack » Version: 2.0.299

cpe:2.3:a:messagepack:messagepack:2.0.299
Messagepack » Messagepack » Version: 2.0.323

cpe:2.3:a:messagepack:messagepack:2.0.323
Messagepack » Messagepack » Version: 2.0.335

cpe:2.3:a:messagepack:messagepack:2.0.335
Messagepack » Messagepack » Version: 2.0.94

cpe:2.3:a:messagepack:messagepack:2.0.94
Messagepack » Messagepack » Version: 2.1.115

cpe:2.3:a:messagepack:messagepack:2.1.115
Messagepack » Messagepack » Version: 2.1.143

cpe:2.3:a:messagepack:messagepack:2.1.143
Messagepack » Messagepack » Version: 2.1.152

cpe:2.3:a:messagepack:messagepack:2.1.152
Messagepack » Messagepack » Version: 2.1.165

cpe:2.3:a:messagepack:messagepack:2.1.165
Messagepack » Messagepack » Version: 2.1.194

cpe:2.3:a:messagepack:messagepack:2.1.194
Messagepack » Messagepack » Version: 2.1.80

cpe:2.3:a:messagepack:messagepack:2.1.80
Messagepack » Messagepack » Version: 2.1.90

cpe:2.3:a:messagepack:messagepack:2.1.90
Messagepack » Messagepack » Version: 2.2.113

cpe:2.3:a:messagepack:messagepack:2.2.113
Messagepack » Messagepack » Version: 2.2.36

cpe:2.3:a:messagepack:messagepack:2.2.36
Messagepack » Messagepack » Version: 2.2.44

cpe:2.3:a:messagepack:messagepack:2.2.44
Messagepack » Messagepack » Version: 2.2.60

cpe:2.3:a:messagepack:messagepack:2.2.60
Messagepack » Messagepack » Version: 2.2.85

cpe:2.3:a:messagepack:messagepack:2.2.85
Messagepack » Messagepack » Version: 2.3.112

cpe:2.3:a:messagepack:messagepack:2.3.112
Messagepack » Messagepack » Version: 2.3.58

cpe:2.3:a:messagepack:messagepack:2.3.58
Messagepack » Messagepack » Version: 2.3.73

cpe:2.3:a:messagepack:messagepack:2.3.73
Messagepack » Messagepack » Version: 2.3.75

cpe:2.3:a:messagepack:messagepack:2.3.75
Messagepack » Messagepack » Version: 2.3.85

cpe:2.3:a:messagepack:messagepack:2.3.85
Messagepack » Messagepack » Version: 2.4.14

cpe:2.3:a:messagepack:messagepack:2.4.14
Messagepack » Messagepack » Version: 2.4.23

cpe:2.3:a:messagepack:messagepack:2.4.23
Messagepack » Messagepack » Version: 2.4.35

cpe:2.3:a:messagepack:messagepack:2.4.35
Messagepack » Messagepack » Version: 2.4.59

cpe:2.3:a:messagepack:messagepack:2.4.59
Messagepack » Messagepack » Version: 2.5.103

cpe:2.3:a:messagepack:messagepack:2.5.103
Messagepack » Messagepack » Version: 2.5.108

cpe:2.3:a:messagepack:messagepack:2.5.108
Messagepack » Messagepack » Version: 2.5.124

cpe:2.3:a:messagepack:messagepack:2.5.124
Messagepack » Messagepack » Version: 2.5.129

cpe:2.3:a:messagepack:messagepack:2.5.129
Messagepack » Messagepack » Version: 2.5.140

cpe:2.3:a:messagepack:messagepack:2.5.140
Messagepack » Messagepack » Version: 2.5.168

cpe:2.3:a:messagepack:messagepack:2.5.168
Messagepack » Messagepack » Version: 2.5.171

cpe:2.3:a:messagepack:messagepack:2.5.171
Messagepack » Messagepack » Version: 2.5.172

cpe:2.3:a:messagepack:messagepack:2.5.172
Messagepack » Messagepack » Version: 2.5.187

cpe:2.3:a:messagepack:messagepack:2.5.187
Messagepack » Messagepack » Version: 2.5.192

cpe:2.3:a:messagepack:messagepack:2.5.192
Messagepack » Messagepack » Version: 2.5.198

cpe:2.3:a:messagepack:messagepack:2.5.198
Messagepack » Messagepack » Version: 2.5.205

cpe:2.3:a:messagepack:messagepack:2.5.205
Messagepack » Messagepack » Version: 2.5.64

cpe:2.3:a:messagepack:messagepack:2.5.64
Messagepack » Messagepack » Version: 2.5.94

cpe:2.3:a:messagepack:messagepack:2.5.94
Messagepack » Messagepack » Version: 3.0.111

cpe:2.3:a:messagepack:messagepack:3.0.111
Messagepack » Messagepack » Version: 3.0.129

cpe:2.3:a:messagepack:messagepack:3.0.129
Messagepack » Messagepack » Version: 3.0.134

cpe:2.3:a:messagepack:messagepack:3.0.134
Messagepack » Messagepack » Version: 3.0.208

cpe:2.3:a:messagepack:messagepack:3.0.208
Messagepack » Messagepack » Version: 3.0.214

cpe:2.3:a:messagepack:messagepack:3.0.214
Messagepack » Messagepack » Version: 3.0.233

cpe:2.3:a:messagepack:messagepack:3.0.233
Messagepack » Messagepack » Version: 3.0.238

cpe:2.3:a:messagepack:messagepack:3.0.238
Messagepack » Messagepack » Version: 3.0.3

cpe:2.3:a:messagepack:messagepack:3.0.3
Messagepack » Messagepack » Version: 3.0.300

cpe:2.3:a:messagepack:messagepack:3.0.300
Messagepack » Messagepack » Version: 3.0.301

cpe:2.3:a:messagepack:messagepack:3.0.301
Messagepack » Messagepack » Version: 3.0.54

cpe:2.3:a:messagepack:messagepack:3.0.54
Messagepack » Messagepack » Version: 3.1.0

cpe:2.3:a:messagepack:messagepack:3.1.0
Messagepack » Messagepack » Version: 3.1.1

cpe:2.3:a:messagepack:messagepack:3.1.1
Messagepack » Messagepack » Version: 3.1.2

cpe:2.3:a:messagepack:messagepack:3.1.2
Messagepack » Messagepack » Version: 3.1.3

cpe:2.3:a:messagepack:messagepack:3.1.3
Messagepack » Messagepack » Version: 3.1.4

cpe:2.3:a:messagepack:messagepack:3.1.4
Messagepack » Messagepack » Version: 3.1.5

cpe:2.3:a:messagepack:messagepack:3.1.5
Messagepack » Messagepack » Version: 3.1.6

cpe:2.3:a:messagepack:messagepack:3.1.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48517

Products

Pricing

Contact Us