CVE-2026-48109

MessagePack-CSharp · Vulnerability

CVSS 3.1 8.2 HIGHEUVD CVSS 3.1 8.2 CVSS 3.1 · [email protected] · Secondary 8.2 HIGHCVSS_V3 Publisher rating HIGHFixed by MessagePack 2.5.301 Fixed by MessagePack 3.1.7KEV status unknown

Original advisory

cve-program · CVE-2026-48109

Published

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

Read the publisher's advisory

euvd · EUVD-2026-38390

Published

Read the publisher's advisory

nvd · CVE-2026-48109

Published

Read the publisher's advisory

osv · GHSA-hv8m-jj95-wg3x

Published

### Impact A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes `Lz4Block` and `Lz4BlockArray`. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an `AccessViolationException` during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This issue affects applications that deserialize untrusted data while LZ4 compression is enabled. ### Patches The v2 versions are patched as of 2.5.301. The v3 versions are patched as of 3.1.7. ### Workarounds Instead of upgrading, an application may take the following precautions: 1. Disable LZ4 compression for untrusted input paths (`Lz4Block`, `Lz4BlockArray`). 2. Only accept compressed payloads from strongly trusted producers. 3. Isolate deserialization in a separate process/container with restart supervision to limit availability impact. ### Resources - MESSAGEPACKCSHARP-010

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-48109

Published

MessagePack-CSharp

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MessagePack-CSharp",
                    "product": "MessagePack-CSharp",
                    "versions": [
                        {
                            "version": ">= 3.1.7, < 3.1.7",
                            "status": "affected"
                        },
                        {
                            "version": "< 2.5.301",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-38390

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 22, 2026, 9:19:54 PM

dateUpdated: Jun 23, 2026, 12:14:29 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-48109

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-20

Original publisher date fields

published: 2026-06-22T22:16:46.617

lastModified: 2026-06-23T17:25:43.420

1 source CPE criteria · context only

cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-hv8m-jj95-wg3x

Published

MessagePack

NuGet

ECOSYSTEM · introduced 0 → fixed 2.5.301

120 versions listed as affected

0.1.0-beta, 0.2.0-beta, 0.2.1-beta, 0.2.2-beta, 0.2.3-beta, 0.3.0-beta, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.6.0, 0.6.1, 0.7.0, 0.7.2, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.1.1.1, 1.1.2, 1.2.0, 1.2.0.1, 1.2.0.2, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.1.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.0.1, 1.5.0.2, 1.5.1, 1.6.0, 1.6.0.1, 1.6.0.2, 1.6.0.3, 1.6.1, 1.6.1.1, 1.6.1.2, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.3.1, 1.7.3.2, 1.7.3.3, 1.7.3.4, 1.7.3.7, 1.8.71-beta, 1.8.74, 1.8.80, 1.9.11, 1.9.3, 1.9.3-g129239b107, 2.0.107-alpha, 2.0.108-alpha, 2.0.110-alpha, 2.0.110-alpha-g1e44a9106f, 2.0.119-beta, 2.0.123-beta, 2.0.171-beta, 2.0.204-beta, 2.0.221-beta, 2.0.231-rc, 2.0.270-rc, 2.0.299-rc, 2.0.323, 2.0.335, 2.1.115, 2.1.143, 2.1.152, 2.1.165, 2.1.194, 2.1.80, 2.1.90, 2.2.113, 2.2.36-alpha, 2.2.44-rc, 2.2.60, 2.2.85, 2.3.112, 2.3.58-alpha, 2.3.73-alpha, 2.3.75, 2.3.85, 2.4.14-alpha, 2.4.23-alpha, 2.4.35, 2.4.59, 2.5.103, 2.5.108, 2.5.124, 2.5.129, 2.5.140, 2.5.168, 2.5.171, 2.5.172, 2.5.187, 2.5.192, 2.5.198, 2.5.205, 2.5.64-alpha, 2.5.94

MessagePack

NuGet

ECOSYSTEM · introduced 3.0.214-rc.1 → fixed 3.1.7

9 versions listed as affected

3.0.300, 3.0.308, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6

Original source record · Cite this exact observation · Complete original publisher JSON