CVE Tools
Track your stack

Messagepack

12 CVEs tracked since 2026. Since Jun 2026, none of them reached CISA KEV.

Messagepack CVEs per month

Jun 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Messagepack CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-06120
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Messagepack's monthly top three, with their CVEs summed over those months.

  1. Messagepack121 month

Latest CVEs

The 13 most recently published vulnerabilities affecting Messagepack.

  1. CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input8.2
  2. CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows7.5
  3. CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth7.5
  4. CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies9.1
  5. CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths7.5
  6. CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps7.5
  7. CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement7.5
  8. CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement7.5
  9. CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length7.5
  10. CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions7.5
  11. CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings7.5
  12. CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments7.5
  13. CVE-2020-5234Untrusted data can lead to DoS attack in MessagePack for C# and Unity4.8

The record

Peak rank
#101 in Jun 2026
Busiest month shown
Jun 2026, 12 CVEs
Months with a KEV entry
0 since Jun 2026
Monthly snapshots
1 since 2026
Messagepack's full record, month by month