CVE-2026-48516

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter constructs an internal Dictionary with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer. This formatter omission allows...

CVE-2026-48510

CVE-2026-48510 affects MessagePack-CSharp. Prior to versions 2.5.301 and 3.1.7, during Lz4Block/Lz4BlockArray decompression the library reads declared uncompressed lengths from the wire and allocates output buffers before validating payload integrity or expansion reasonableness. This can allow a ...

CVE-2026-48513

CVE-2026-48513 — MessagePack-CSharp : Vulnerability in runtime-generated union deserializers by DynamicUnionResolver allows depth enforcement gaps. Prior to versions 2.5.301 and 3.1.7, deserializers did not call MessagePackSecurity.DepthStep(ref reader) or properly adjust reader.Depth during recu...