CVE-2026-48109 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.
A denial-of-service vulnerability has been identified in MessagePack for C# versions prior to 2.5.301 and 3.1.7. The issue arises in the optional LZ4 decompression path used by the MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder relies on a deprecated fast-decompression algorithm that lacks a source-length bound, allowing remote attackers to send crafted MessagePack payloads with manipulated LZ4 token and length fields. This can cause out-of-bounds reads from the compressed input buffer, triggering an AccessViolationException that terminates the process. In some cases, limited unintended memory disclosure from the over-read data may occur before the failure.
Users can upgrade to MessagePack for C# versions 2.5.301 or 3.1.7 to address this vulnerability. Alternatively, LZ4 compression can be disabled for untrusted input paths or only compressed payloads from trusted sources can be accepted.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-hv8m-jj95-wg3x | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |