CVE-2026-48517

CVE-2026-48517 affects MessagePack for C# where typeless deserialization does not recursively inspect array element types or generic type arguments, allowing a type that is blocked directly to slip through when wrapped in an array or a constructed generic type. The default safety check (ThrowIfDe...