High severity7.5NVD Advisory· Published Jun 22, 2026· Updated Jun 25, 2026
CVE-2026-48510
CVE-2026-48510
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
MessagePackNuGet | < 2.5.301 | 2.5.301 |
MessagePackNuGet | >= 3.0, < 3.1.7 | 3.1.7 |
Affected products
2- Range: <2.5.301 and <3.1.7
Patches
Vulnerability mechanics
References
3- github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8mnvdMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-v72x-2h86-7f8mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-48510ghsaADVISORY
News mentions
1- MessagePack C#: Ten Vulnerabilities Disclosed Together, Affecting Deserialization and SecurityVypr Intelligence · Jun 22, 2026