CVE-2026-48510

CVE-2026-48510 affects MessagePack-CSharp. Prior to versions 2.5.301 and 3.1.7, during Lz4Block/Lz4BlockArray decompression the library reads declared uncompressed lengths from the wire and allocates output buffers before validating payload integrity or expansion reasonableness. This can allow a ...