CVE-2026-44375Published

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

cve-program · CVE-2026-44375

Published

Nerdbank.MessagePack

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "AArnott",
                    "product": "Nerdbank.MessagePack",
                    "versions": [
                        {
                            "version": "< 1.1.62",
                            "status": "affected"
                        }
                    ]
                }

euvd · EUVD-2026-30299

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

nvd · CVE-2026-44375

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-2cwq-pwfr-wcw3

Published

Nerdbank.MessagePack

NuGet

ECOSYSTEM · introduced 0 → fixed 1.1.62

47 explicitly affected versions

0.1.705-alpha-gad428877b7, 0.1.734-alpha-g09268fd45c, 0.10.2-rc, 0.10.7-rc, 0.2.108-alpha, 0.2.2-alpha, 0.2.34-alpha, 0.2.52-alpha, 0.2.82-alpha, 0.3.120-beta, 0.3.151-beta, 0.3.161-beta, 0.3.2-alpha, 0.3.27-alpha, 0.3.38-beta, 0.4.5-beta, 0.5.1-beta, 0.5.37-beta, 0.5.57-beta, 0.5.72-beta, 0.5.80-beta, 0.6.1-beta, 0.6.27-beta, 0.6.7-beta, 0.7.1-beta, 0.8.1-rc, 0.8.102-rc, 0.8.111-rc, 0.8.128-rc, 0.8.131-rc, 0.8.30-rc, 0.8.46-rc, 0.8.54-rc, 0.8.67-rc, 0.8.82-rc, 0.8.90-rc, 0.8.92-rc, 0.9.12-rc, 0.9.14-rc, 0.9.23-rc, 0.9.26-rc, 0.9.35-rc, 1.0.11, 1.0.2, 1.0.40, 1.0.43, 1.1.25