CVE-2026-48510 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
A vulnerability exists in MessagePack for C# versions prior to 2.5.301 and 3.1.7, where the library improperly handles LZ4 compressed data. During decompression, it reads uncompressed length declarations from the payload and allocates memory based on these lengths without first validating the compressed data or the reasonableness of the declared sizes. This flaw can be exploited by a small payload claiming a large uncompressed length, leading to excessive memory allocation before the LZ4 data is decoded. The issue is particularly concerning when deserializing MessagePack data that could be controlled by an attacker, potentially causing out-of-memory errors, process crashes on resource-limited systems, or significant memory strain.
Users are advised to upgrade to MessagePack for C# versions 2.5.301 or 3.1.7. Additionally, if using companion MessagePack packages, upgrade those to the coordinated patched versions. Until the upgrade, avoid using the built-in LZ4 compression modes with untrusted inputs. If compression is necessary, impose strict limits on compressed and decompressed sizes before deserialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8m | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |