CVE Tools
Track your stack

Messagepack

18 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Messagepack, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Messagepack CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Messagepack CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-040
2026-050
2026-0613
2026-071
2026-080
2026-090
2026-100

Severity

How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical16%
  • High1482%
  • Medium212%

Latest CVEs

The 15 most recently published vulnerabilities affecting Messagepack.

  1. CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure5.4
  2. CVE-2026-57585MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error7.5
  3. CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input8.2
  4. CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows7.5
  5. CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth7.5
  6. CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies9.1
  7. CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths7.5
  8. CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps7.5
  9. CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement7.5
  10. CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement7.5
  11. CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length7.5
  12. CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions7.5
  13. CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings7.5
  14. CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments7.5
  15. CVE-2026-21452MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation7.5

Product grouping is registry-driven, with AI assist and human review. How it works