CVE Tools
Track your stack

Messagepack-csharp

12 CVEs tracked since 2026. Since Jun 2026, none of them reached CISA KEV.

Messagepack-csharp CVEs per month

Jun 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Messagepack-csharp CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-06120
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Messagepack-csharp's monthly top three, with their CVEs summed over those months.

  1. Messagepack-csharp121 month

Latest CVEs

The 14 most recently published vulnerabilities affecting Messagepack-csharp.

  1. CVE-2026-92707MessagePack: Nested arrays can blow past buffer length limits5.3
  2. CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input8.2
  3. CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows7.5
  4. CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth7.5
  5. CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies9.1
  6. CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths7.5
  7. CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps7.5
  8. CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement7.5
  9. CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement7.5
  10. CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length7.5
  11. CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions7.5
  12. CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings7.5
  13. CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments7.5
  14. CVE-2024-48924MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow—

The record

Peak rank
#102 in Jun 2026
Busiest month shown
Jun 2026, 12 CVEs
Months with a KEV entry
0 since Jun 2026
Monthly snapshots
1 since 2026
Messagepack-csharp's full record, month by month