CVE-2026-48510: messagepack-csharp

Vulnerability summary

CVE-2026-48510 is a high (CVSS 7.5) vulnerability in messagepack-csharp. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.3% of scored vulnerabilities.

Timeline

1. 22-06-2026
   PublishedVulnerability first disclosed.
2. 25-06-2026
   Last modifiedVulnerability information updated.

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

• CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.