Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-48109
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input 22 Jun
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-48502
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows 22 Jun
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-48506
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth 22 Jun
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-48509
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48510
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48511
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48512
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48513
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48514
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48515
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48516
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-48517
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments 22 Jun
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2024-48924
  • github.com/messagepack-csharp/messagepack-csharp
 MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow 17 Oct 2024
  • Fix available
  • Severity - 8.7 (High)
CVE-2020-5234
  • github.com/messagepack-csharp/messagepack-csharp
 See record for full details 31 Jan 2020
  • Fix available
  • Severity - 6.5 (Medium)