MessagePack Serializer for C# Vulnerability Exposes Applications to Resource Allocation Issues

CVE-2026-48510

What is CVE-2026-48510?

MessagePack for C# is a serializer that may allow an attacker to exploit improper handling of payload sizes during the decompression of Lz4Block or Lz4BlockArray inputs. Before versions 2.5.301 and 3.1.7, it inaccurately reads uncompressed lengths from the data stream, leading to the possibility of allocating excessive resources based on misleading length declarations. This issue opens up potential denial of service risks and undue resource consumption as the application attempts to decode what may be deceptively small payloads claiming larger uncompressed sizes.

References