CVE-2026-48517
- Source
- https://cve.org/CVERecord?id=CVE-2026-48517
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48517.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-48517
- Aliases
- Published
- 2026-06-22T21:03:30.437Z
- Modified
- 2026-08-12T03:51:15.840819982Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
- Details
-
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Database specific
{ "cwe_ids": [ "CWE-470", "CWE-502" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48517.json" }- References
Affected packages
Git / github.com/messagepack-csharp/messagepack-csharp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/messagepack-csharp/messagepack-csharp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixed
- Database specific
-
Show details
{ "source": "CPE_RANGE", "cpe": "cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\\#:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "2.5.301" }, { "introduced": "3.0.3" }, { "fixed": "3.1.7" } ] }
Affected versions
0.*
0.1.0-beta
0.2.0-beta
1.*
1.0.1
v1.*
v1.0.2
v1.0.3
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.4
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.1.2
v1.6.2
v1.7.0
v1.7.2
v1.7.3
v1.7.3.1
v1.7.3.2
v1.7.3.3
v1.7.3.4
v2.*
v2.0.110-alpha
v2.0.119-beta
v2.0.123-beta
v2.0.204-beta
v2.0.270-rc
v2.0.94-alpha
v2.1.115
v2.1.143
v2.1.152
v2.1.165
v2.1.194
v2.1.80
v2.1.90
v2.2.113
v2.2.60
v2.2.85
v2.3.75
v2.3.85
v2.4.23-alpha
v2.4.35
v2.4.59
v2.5.103
v2.5.108
v2.5.124
v2.5.129
v2.5.140
v2.5.168
v2.5.171
v2.5.172
v2.5.187
v2.5.192
v2.5.198
v2.5.94
v3.*
v3.0.3
v3.0.300
v3.0.301
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6