CVE-2026-48510

CVE-2026-48510 affects MessagePack-CSharp. Prior to versions 2.5.301 and 3.1.7, during Lz4Block/Lz4BlockArray decompression the library reads declared uncompressed lengths from the wire and allocates output buffers before validating payload integrity or expansion reasonableness. This can allow a ...

CVE-2026-48513

CVE-2026-48513 — MessagePack-CSharp : Vulnerability in runtime-generated union deserializers by DynamicUnionResolver allows depth enforcement gaps. Prior to versions 2.5.301 and 3.1.7, deserializers did not call MessagePackSecurity.DepthStep(ref reader) or properly adjust reader.Depth during recu...