MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the target multi-dimensional array happens before the dimensions are checked against that element count. A small payload can therefore declare large dimensions, provide an empty or tiny inner array, and cause a large heap allocation before element data is validated. This vulnerability is fixed in 2.5.301 and 3.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's
    multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,],
    T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The
    formatter reads a guarded element array header, but allocation of the target multi-dimensional array
    happens before the dimensions are checked against that element count. A small payload can therefore
    declare large dimensions, provide an empty or tiny inner array, and cause a large heap allocation before
    element data is validated. This vulnerability is fixed in 2.5.301 and 3.1.7. (CVE-2026-48515)

ID	Name	Product	Family	Type	Severity
464159	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464159	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443956	SCA: security update for MessagePack (GHSA-cxmj-83gh-fp49)	Tenable Cloud Security	SCA Checks	Local	medium
443956	SCA: security update for MessagePack (GHSA-cxmj-83gh-fp49)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48515

medium

Tenable Plugins

medium

medium

medium

medium