CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48513

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 10.8%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh

Products affected by CVE-2026-48513

Messagepack » Messagepack » Version: .1.7.3.5

cpe:2.3:a:messagepack:messagepack:.1.7.3.5
Messagepack » Messagepack » Version: .1.7.3.6

cpe:2.3:a:messagepack:messagepack:.1.7.3.6
Messagepack » Messagepack » Version: 1.0.1

cpe:2.3:a:messagepack:messagepack:1.0.1
Messagepack » Messagepack » Version: 1.0.2

cpe:2.3:a:messagepack:messagepack:1.0.2
Messagepack » Messagepack » Version: 1.0.3

cpe:2.3:a:messagepack:messagepack:1.0.3
Messagepack » Messagepack » Version: 1.1.0

cpe:2.3:a:messagepack:messagepack:1.1.0
Messagepack » Messagepack » Version: 1.1.1

cpe:2.3:a:messagepack:messagepack:1.1.1
Messagepack » Messagepack » Version: 1.1.2

cpe:2.3:a:messagepack:messagepack:1.1.2
Messagepack » Messagepack » Version: 1.2.0

cpe:2.3:a:messagepack:messagepack:1.2.0
Messagepack » Messagepack » Version: 1.2.1

cpe:2.3:a:messagepack:messagepack:1.2.1
Messagepack » Messagepack » Version: 1.2.3

cpe:2.3:a:messagepack:messagepack:1.2.3
Messagepack » Messagepack » Version: 1.3.0

cpe:2.3:a:messagepack:messagepack:1.3.0
Messagepack » Messagepack » Version: 1.3.1

cpe:2.3:a:messagepack:messagepack:1.3.1
Messagepack » Messagepack » Version: 1.3.2

cpe:2.3:a:messagepack:messagepack:1.3.2
Messagepack » Messagepack » Version: 1.3.3

cpe:2.3:a:messagepack:messagepack:1.3.3
Messagepack » Messagepack » Version: 1.4.0

cpe:2.3:a:messagepack:messagepack:1.4.0
Messagepack » Messagepack » Version: 1.4.1

cpe:2.3:a:messagepack:messagepack:1.4.1
Messagepack » Messagepack » Version: 1.4.2

cpe:2.3:a:messagepack:messagepack:1.4.2
Messagepack » Messagepack » Version: 1.4.3

cpe:2.3:a:messagepack:messagepack:1.4.3
Messagepack » Messagepack » Version: 1.4.4

cpe:2.3:a:messagepack:messagepack:1.4.4
Messagepack » Messagepack » Version: 1.5.0

cpe:2.3:a:messagepack:messagepack:1.5.0
Messagepack » Messagepack » Version: 1.5.1

cpe:2.3:a:messagepack:messagepack:1.5.1
Messagepack » Messagepack » Version: 1.6.0

cpe:2.3:a:messagepack:messagepack:1.6.0
Messagepack » Messagepack » Version: 1.6.1

cpe:2.3:a:messagepack:messagepack:1.6.1
Messagepack » Messagepack » Version: 1.6.1.2

cpe:2.3:a:messagepack:messagepack:1.6.1.2
Messagepack » Messagepack » Version: 1.6.2

cpe:2.3:a:messagepack:messagepack:1.6.2
Messagepack » Messagepack » Version: 1.7.0

cpe:2.3:a:messagepack:messagepack:1.7.0
Messagepack » Messagepack » Version: 1.7.1

cpe:2.3:a:messagepack:messagepack:1.7.1
Messagepack » Messagepack » Version: 1.7.2

cpe:2.3:a:messagepack:messagepack:1.7.2
Messagepack » Messagepack » Version: 1.7.3

cpe:2.3:a:messagepack:messagepack:1.7.3
Messagepack » Messagepack » Version: 1.7.3.1

cpe:2.3:a:messagepack:messagepack:1.7.3.1
Messagepack » Messagepack » Version: 1.7.3.2

cpe:2.3:a:messagepack:messagepack:1.7.3.2
Messagepack » Messagepack » Version: 1.7.3.3

cpe:2.3:a:messagepack:messagepack:1.7.3.3
Messagepack » Messagepack » Version: 1.7.3.4

cpe:2.3:a:messagepack:messagepack:1.7.3.4
Messagepack » Messagepack » Version: 1.7.3.7

cpe:2.3:a:messagepack:messagepack:1.7.3.7
Messagepack » Messagepack » Version: 1.9.3

cpe:2.3:a:messagepack:messagepack:1.9.3
Messagepack » Messagepack » Version: 2.0.110

cpe:2.3:a:messagepack:messagepack:2.0.110
Messagepack » Messagepack » Version: 2.0.119

cpe:2.3:a:messagepack:messagepack:2.0.119
Messagepack » Messagepack » Version: 2.0.123

cpe:2.3:a:messagepack:messagepack:2.0.123
Messagepack » Messagepack » Version: 2.0.204

cpe:2.3:a:messagepack:messagepack:2.0.204
Messagepack » Messagepack » Version: 2.0.270

cpe:2.3:a:messagepack:messagepack:2.0.270
Messagepack » Messagepack » Version: 2.0.299

cpe:2.3:a:messagepack:messagepack:2.0.299
Messagepack » Messagepack » Version: 2.0.323

cpe:2.3:a:messagepack:messagepack:2.0.323
Messagepack » Messagepack » Version: 2.0.335

cpe:2.3:a:messagepack:messagepack:2.0.335
Messagepack » Messagepack » Version: 2.0.94

cpe:2.3:a:messagepack:messagepack:2.0.94
Messagepack » Messagepack » Version: 2.1.115

cpe:2.3:a:messagepack:messagepack:2.1.115
Messagepack » Messagepack » Version: 2.1.143

cpe:2.3:a:messagepack:messagepack:2.1.143
Messagepack » Messagepack » Version: 2.1.152

cpe:2.3:a:messagepack:messagepack:2.1.152
Messagepack » Messagepack » Version: 2.1.165

cpe:2.3:a:messagepack:messagepack:2.1.165
Messagepack » Messagepack » Version: 2.1.194

cpe:2.3:a:messagepack:messagepack:2.1.194
Messagepack » Messagepack » Version: 2.1.80

cpe:2.3:a:messagepack:messagepack:2.1.80
Messagepack » Messagepack » Version: 2.1.90

cpe:2.3:a:messagepack:messagepack:2.1.90
Messagepack » Messagepack » Version: 2.2.113

cpe:2.3:a:messagepack:messagepack:2.2.113
Messagepack » Messagepack » Version: 2.2.36

cpe:2.3:a:messagepack:messagepack:2.2.36
Messagepack » Messagepack » Version: 2.2.44

cpe:2.3:a:messagepack:messagepack:2.2.44
Messagepack » Messagepack » Version: 2.2.60

cpe:2.3:a:messagepack:messagepack:2.2.60
Messagepack » Messagepack » Version: 2.2.85

cpe:2.3:a:messagepack:messagepack:2.2.85
Messagepack » Messagepack » Version: 2.3.112

cpe:2.3:a:messagepack:messagepack:2.3.112
Messagepack » Messagepack » Version: 2.3.58

cpe:2.3:a:messagepack:messagepack:2.3.58
Messagepack » Messagepack » Version: 2.3.73

cpe:2.3:a:messagepack:messagepack:2.3.73
Messagepack » Messagepack » Version: 2.3.75

cpe:2.3:a:messagepack:messagepack:2.3.75
Messagepack » Messagepack » Version: 2.3.85

cpe:2.3:a:messagepack:messagepack:2.3.85
Messagepack » Messagepack » Version: 2.4.14

cpe:2.3:a:messagepack:messagepack:2.4.14
Messagepack » Messagepack » Version: 2.4.23

cpe:2.3:a:messagepack:messagepack:2.4.23
Messagepack » Messagepack » Version: 2.4.35

cpe:2.3:a:messagepack:messagepack:2.4.35
Messagepack » Messagepack » Version: 2.4.59

cpe:2.3:a:messagepack:messagepack:2.4.59
Messagepack » Messagepack » Version: 2.5.103

cpe:2.3:a:messagepack:messagepack:2.5.103
Messagepack » Messagepack » Version: 2.5.108

cpe:2.3:a:messagepack:messagepack:2.5.108
Messagepack » Messagepack » Version: 2.5.124

cpe:2.3:a:messagepack:messagepack:2.5.124
Messagepack » Messagepack » Version: 2.5.129

cpe:2.3:a:messagepack:messagepack:2.5.129
Messagepack » Messagepack » Version: 2.5.140

cpe:2.3:a:messagepack:messagepack:2.5.140
Messagepack » Messagepack » Version: 2.5.168

cpe:2.3:a:messagepack:messagepack:2.5.168
Messagepack » Messagepack » Version: 2.5.171

cpe:2.3:a:messagepack:messagepack:2.5.171
Messagepack » Messagepack » Version: 2.5.172

cpe:2.3:a:messagepack:messagepack:2.5.172
Messagepack » Messagepack » Version: 2.5.187

cpe:2.3:a:messagepack:messagepack:2.5.187
Messagepack » Messagepack » Version: 2.5.192

cpe:2.3:a:messagepack:messagepack:2.5.192
Messagepack » Messagepack » Version: 2.5.198

cpe:2.3:a:messagepack:messagepack:2.5.198
Messagepack » Messagepack » Version: 2.5.205

cpe:2.3:a:messagepack:messagepack:2.5.205
Messagepack » Messagepack » Version: 2.5.64

cpe:2.3:a:messagepack:messagepack:2.5.64
Messagepack » Messagepack » Version: 2.5.94

cpe:2.3:a:messagepack:messagepack:2.5.94
Messagepack » Messagepack » Version: 3.0.111

cpe:2.3:a:messagepack:messagepack:3.0.111
Messagepack » Messagepack » Version: 3.0.129

cpe:2.3:a:messagepack:messagepack:3.0.129
Messagepack » Messagepack » Version: 3.0.134

cpe:2.3:a:messagepack:messagepack:3.0.134
Messagepack » Messagepack » Version: 3.0.208

cpe:2.3:a:messagepack:messagepack:3.0.208
Messagepack » Messagepack » Version: 3.0.214

cpe:2.3:a:messagepack:messagepack:3.0.214
Messagepack » Messagepack » Version: 3.0.233

cpe:2.3:a:messagepack:messagepack:3.0.233
Messagepack » Messagepack » Version: 3.0.238

cpe:2.3:a:messagepack:messagepack:3.0.238
Messagepack » Messagepack » Version: 3.0.3

cpe:2.3:a:messagepack:messagepack:3.0.3
Messagepack » Messagepack » Version: 3.0.300

cpe:2.3:a:messagepack:messagepack:3.0.300
Messagepack » Messagepack » Version: 3.0.301

cpe:2.3:a:messagepack:messagepack:3.0.301
Messagepack » Messagepack » Version: 3.0.54

cpe:2.3:a:messagepack:messagepack:3.0.54
Messagepack » Messagepack » Version: 3.1.0

cpe:2.3:a:messagepack:messagepack:3.1.0
Messagepack » Messagepack » Version: 3.1.1

cpe:2.3:a:messagepack:messagepack:3.1.1
Messagepack » Messagepack » Version: 3.1.2

cpe:2.3:a:messagepack:messagepack:3.1.2
Messagepack » Messagepack » Version: 3.1.3

cpe:2.3:a:messagepack:messagepack:3.1.3
Messagepack » Messagepack » Version: 3.1.4

cpe:2.3:a:messagepack:messagepack:3.1.4
Messagepack » Messagepack » Version: 3.1.5

cpe:2.3:a:messagepack:messagepack:3.1.5
Messagepack » Messagepack » Version: 3.1.6

cpe:2.3:a:messagepack:messagepack:3.1.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48513

Products

Pricing

Contact Us