CVE-2026-48510

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

Published Jun 22, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

Analysis

Technical impact

The reported vulnerability lies in the LZ4 decompression path of the MessagePack-CSharp library. A small compressed payload with a large claimed uncompressed length can force an allocator to reserve a huge buffer before the data is validated, causing a memory exhaustion that crashes or slows the running process. This buffer allocation based on untrusted data corresponds to CWE‑409 and CWE‑770.

Affected Systems

The issue affects the MessagePack-CSharp library, versions prior to 2.5.301 in the 2.x line and prior to 3.1.7 in the 3.x line. Any application that deserializes LZ4‑compressed MessagePack data using these library versions is vulnerable.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is available, so the exploitation probability is unknown, but the flaw can be triggered with any LZ4 payload, making an attack straightforward. The likely vector is network or file‑based, targeting any system that accepts LZ4 input from an external source. The attacker requires no elevated privileges; the application using the library is the only necessary context.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MessagePack-CSharp

affected

Version	Status	Constraints
`>= 3.0, < 3.1.7`	affected	—
`< 2.5.301`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:messagepack:messagepack::::::c\#::*
	cpe:2.3:a:messagepack:messagepack::::::c\#::*

No data.

Vendor Product Versions

Messagepack

Messagepack-csharp

Version	Status	Scheme	Platform
`[3.1.7,3.1.7)`	affected	semver	—
`[0,2.5.301)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade MessagePack-CSharp to version 2.5.301 or newer, or to 3.1.7 or newer, ensuring the library deallocates after successful validation.
Replace or patch existing code to load the updated library in all affected application deployments.
If an upgrade path is not immediately possible, implement a defensive check that verifies the claimed uncompressed length does not exceed a reasonable bound before allocating memory, or reject the payload entirely.

Generated by OpenCVE AI on June 22, 2026 at 23:26 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-v72x-2h86-7f8m	MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.405% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8m

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Messagepack Messagepack messagepack-csharp
Vendors & Products		Messagepack Messagepack messagepack-csharp

Jun 23, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
Title		MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Weaknesses		CWE-409 CWE-770
References		https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8m
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`