CVE-2026-48510

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description When decompressing Lz4Block or Lz4BlockArray payloads, the software reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating the compressed data or ensuring the declared expansion is reasonable. This allows a small payload to claim an excessively large uncompressed length, forcing a large memory allocation before LZ4 decoding begins.

Recommendations Update to version 2.5.301. Update to version 3.1.7.