CVE-2026-48510
Last modified
CVE-2026-48510 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Messagepack | Messagepack | < 2.5.301 |
| Messagepack | Messagepack | >= 3.0.3, < 3.1.7 |
References
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8mMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-48510?
How severe is CVE-2026-48510?
How do I fix CVE-2026-48510?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48504OpenTelemetry Rust is the Rust OpenTelemetry implementation.…5.3
- CVE-2026-48505Filament is a collection of full-stack components for accele…7.4
- CVE-2026-48506MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48507Snipe-IT is an IT asset/license management system. A vulnera…7.1
- CVE-2026-48509MessagePack for C# is a MessagePack serializer for C#. Prior…9.1
- CVE-2026-4851GRID::Machine versions through 0.127 for Perl allows arbitra…9.8
- CVE-2026-48511MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48512MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48513MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48514MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48515MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
- CVE-2026-48516MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
Are you affected by CVE-2026-48510?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST