MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's
    typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type)
    as a safety check for dangerous types. The default implementation checks the outer type name, but it does
    not recursively inspect array element types or generic type arguments. As a result, a type that would be
    blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check.
    The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is
    fixed in 2.5.301 and 3.1.7. (CVE-2026-48517)

ID	Name	Product	Family	Type	Severity
460992	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460992	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443990	SCA: security update for MessagePack (GHSA-qhmf-xw27-6rqr)	Tenable Cloud Security	SCA Checks	Local	medium
443990	SCA: security update for MessagePack (GHSA-qhmf-xw27-6rqr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48517

medium

Tenable Plugins

medium

medium

medium

medium