Resource exhaustion in Messagepack
CVE-2026-48510
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (32.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 32.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Messagepack
- Messagepack-Csharp — versions >= 3.1.7, < 3.1.7, >= 3.0, < 3.1.7, < 2.5.301
Weakness classification (CWE)
References
- github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-… (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-48510?
- CVE-2026-48510 is a high-severity vulnerability in Messagepack, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2026-06-22.
- How severe is CVE-2026-48510?
- High severity. CVSS v3 base score is 7.5 out of 10.