Vulnerability Database
Blog
FAQ
Docs
arrow_forward
search
light_mode
dark_mode
ECHO-e60c-e8f0-b786
See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-e60c-e8f0-b786.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-e60c-e8f0-b786
Upstream
CVE-2026-48509
GHSA-2f33-pr97-265q
Withdrawn
2026-11-12T08:00:07Z
Published
2026-06-25T18:52:46Z
Modified
2026-11-12T08:20:25Z
Summary
MVC input formatter TrustedData default (CWE-1188). Upstream c98d31f2 only touches MessagePack.AspNetCoreMvcFormatter, a separate package — not any shipped MessagePack.dll TFM. Patch retained in patches/ but not applied.
Details
References
https://advisory.echohq.com/cve/CVE-2026-48509
https://github.com/advisories/GHSA-2f33-pr97-265q
Affected packages
Echo:NuGet
/
MessagePack
Package
Name
MessagePack
Purl
pkg:nuget/MessagePack
Affected ranges
Type
ECOSYSTEM
Events
Introduced
0
Unknown introduced version / All previous versions are affected
Fixed
2.5.172+echo.1
Database specific
source
"https://advisory.echohq.com/osv/ECHO-e60c-e8f0-b786.json"
ECHO-e60c-e8f0-b786 - OSV