{"id":"EUVD-2026-30299","enisaUuid":"46f19249-3e8e-3fd1-b0ac-785c477d5ead","description":"Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.","datePublished":"May 14, 2026, 2:32:09 PM","dateUpdated":"May 14, 2026, 4:02:12 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3\nhttps://github.com/AArnott/Nerdbank.MessagePack/pull/941\nhttps://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30\nhttps://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62\n","aliases":"CVE-2026-44375\nGHSA-2cwq-pwfr-wcw3\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"bb9745b1-c794-3c69-a1c5-516a23edf963","product":{"name":"Nerdbank.MessagePack","vendor":{"name":"AArnott"}},"product_version":"\u003c 1.1.62"}],"enisaIdVendor":[{"id":"9da4ae90-1143-3074-984f-4741aa539bae","vendor":{"name":"AArnott"}}],"enisaIdVulnerability":[{"id":"314ea2ae-6f6e-36a6-bc50-7ee7a225b7b5","vulnerability":{"id":"CVE-2026-44375","description":"Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.","datePublished":"May 14, 2026, 2:32:09 PM","dateUpdated":"May 14, 2026, 4:02:12 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3\nhttps://github.com/AArnott/Nerdbank.MessagePack/pull/941\nhttps://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30\nhttps://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62\n","enisa_id":"EUVD-2026-30299\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"f620a0d8-b296-36c8-8114-3c96aa914ca0","product":{"name":"Nerdbank.MessagePack","vendor":{"name":"AArnott"}},"product_version":"\u003c 1.1.62"}],"vulnerabilityVendor":[{"id":"e8c9c585-a0b5-3bd2-be4a-49fba169f114","vendor":{"name":"AArnott"}}]}},{"id":"d7a075d4-f4e6-3973-9f9d-0d7a87f6cc27","vulnerability":{"id":"GHSA-2cwq-pwfr-wcw3","description":"Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException","datePublished":"May 6, 2026, 11:05:52 PM","dateUpdated":"May 14, 2026, 8:49:35 PM","baseScore":0.0,"references":"https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44375\nhttps://github.com/AArnott/Nerdbank.MessagePack/pull/941\nhttps://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30\nhttps://github.com/AArnott/Nerdbank.MessagePack\nhttps://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62\nhttps://github.com/msgpack/msgpack/blob/master/spec.md#timestamp-extension-type\n","enisa_id":"EUVD-2026-30299\n","aliases":"GHSA-2cwq-pwfr-wcw3\nCVE-2026-44375\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}