CVE-2026-48510

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48510
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48510.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48510
Aliases
Published
2026-06-22T21:16:04Z
Modified
2026-08-27T03:30:44Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Details

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-409",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48510.json"
}
References

Affected packages

Git / github.com/messagepack-csharp/messagepack-csharp

Affected ranges

Type
GIT
Repo
https://github.com/messagepack-csharp/messagepack-csharp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5657b1e34ea2869a2ca6bc0aa6617158620201ba
Introduced
ff3af77f546138d9da71707baddf2c30f55dfc15
Fixed
1b53ae8b7681340199faf337bcbb0eb5aed702de
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\\#:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.301"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "fixed": "3.1.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.1.0-beta
0.2.0-beta
1.*
1.0.1
v1.*
v1.0.2
v1.0.3
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.4
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.1.2
v1.6.2
v1.7.0
v1.7.2
v1.7.3
v1.7.3.1
v1.7.3.2
v1.7.3.3
v1.7.3.4
v2.*
v2.0.110-alpha
v2.0.119-beta
v2.0.123-beta
v2.0.204-beta
v2.0.270-rc
v2.0.94-alpha
v2.1.115
v2.1.143
v2.1.152
v2.1.165
v2.1.194
v2.1.80
v2.1.90
v2.2.113
v2.2.60
v2.2.85
v2.3.75
v2.3.85
v2.4.23-alpha
v2.4.35
v2.4.59
v2.5.103
v2.5.108
v2.5.124
v2.5.129
v2.5.140
v2.5.168
v2.5.171
v2.5.172
v2.5.187
v2.5.192
v2.5.198
v2.5.94
v3.*
v3.0.3
v3.0.300
v3.0.301
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48510.json"