Security
فارسی
All products

messagepack

NuGet · Package
15 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
MessagePack: Nested arrays can blow past buffer length limitsCVE-2026-92707 · GHSA-QHRR-8Q5H-9Q3H messagepack NuGet Medium Fix reported
MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad inputCVE-2026-48109 · GHSA-HV8M-JJ95-WG3X messagepack NuGet High Fix reported
MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowCVE-2024-48924 · GHSA-4QM4-8HG2-G2XM messagepack NuGet Medium Fix reported
Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePackCVE-2020-5234 · GHSA-7Q36-4XX7-XCXF messagepack.immutablecollectionmessagepack.reactiveproperty NuGet Medium Fix reported
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsCVE-2026-48517 · GHSA-QHMF-XW27-6RQR messagepack NuGet Medium Fix reported
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsCVE-2026-48516 · GHSA-Q2H6-GHWM-5QM8 messagepack NuGet Medium Fix reported
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsCVE-2026-48515 · GHSA-CXMJ-83GH-FP49 messagepack NuGet Medium Fix reported
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthCVE-2026-48514 · GHSA-W567-GJR2-HM5J messagepack NuGet Medium Fix reported
MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcementCVE-2026-48513 · GHSA-WFR3-XJ75-PFWH messagepack NuGet Medium Fix reported
MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementCVE-2026-48512 · GHSA-CJ9G-3MJ2-G8VV messagepack NuGet Medium Fix reported
MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsCVE-2026-48511 · GHSA-2X83-8G95-XH59 messagepack NuGet Medium Fix reported
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsCVE-2026-48510 · GHSA-V72X-2H86-7F8M messagepack NuGet Medium Fix reported
MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodiesCVE-2026-48509 · GHSA-2F33-PR97-265Q messagepack NuGet Medium Fix reported
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthCVE-2026-48506 · GHSA-VH6J-JC39-FGGF messagepack NuGet High Fix reported
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsCVE-2026-48502 · GHSA-382J-8MXH-C7X2 messagepack NuGet High Fix reported