ECHO-e60c-e8f0-b786

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-e60c-e8f0-b786.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-e60c-e8f0-b786
Upstream
Withdrawn
2026-11-12T08:00:07Z
Published
2026-06-25T18:52:46Z
Modified
2026-11-12T08:20:25Z
Summary
MVC input formatter TrustedData default (CWE-1188). Upstream c98d31f2 only touches MessagePack.AspNetCoreMvcFormatter, a separate package — not any shipped MessagePack.dll TFM. Patch retained in patches/ but not applied.
Details
References

Affected packages

Echo:NuGet / MessagePack

Package

Name
MessagePack
Purl
pkg:nuget/MessagePack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.172+echo.1

Database specific

source
"https://advisory.echohq.com/osv/ECHO-e60c-e8f0-b786.json"