Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 MessagePack-CSharp, Unbounded Memory Allocation, #CVE-2026-48510 (Medium) -DC-Jun2026-644 https://dailycve.com/messagepack-csharp-unbounded-memory-allocation-cve-2026-48510-medium-dc-jun2026-644/
Post summary
A new CVE (CVE-2026-48510) affecting MessagePack-CSharp is announced, labeled a medium‑severity unbounded memory allocation flaw; no PoC, exploit, active use, patch, or debunking details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | messagepack | messagepack | - | c\# | - |