MessagePack vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48517MediumMessagePack: MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVE-2026-48516MediumMessagePack: MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings CVE-2026-48515MediumMessagePack: MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions CVE-2026-48514MediumMessagePack: MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length CVE-2026-48513MediumMessagePack: MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement CVE-2026-48512MediumMessagePack: MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement CVE-2026-48511MediumMessagePack: MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps CVE-2026-48510MediumMessagePack: MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths CVE-2026-48509MediumMessagePack: MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies CVE-2026-48506HighMessagePack: MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVE-2026-48502HighMessagePack: MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows CVE-2026-48109HighMessagePack: MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVE-2024-48924MediumMessagePack: MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow CVE-2020-5234MediumMessagePack: Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo