MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists
    in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray.
    The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a
    source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4
    token/length fields to force out-of-bounds reads from the compressed input buffer. In affected
    environments, this can trigger an AccessViolationException during decompression, causing process
    termination (denial of service). Under some conditions, limited unintended memory disclosure from over-
    read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.
    (CVE-2026-48109)

ID	Name	Product	Family	Type	Severity
464146	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
464146	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443098	SCA: security update for MessagePack (GHSA-hv8m-jj95-wg3x)	Tenable Cloud Security	SCA Checks	Local	high
443098	SCA: security update for MessagePack (GHSA-hv8m-jj95-wg3x)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-48109

high

Tenable Plugins

high

high

high

high