MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96235)

  - Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

  - Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose
    information over a network. (CVE-2026-66822)

  - Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

  - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows     an unauthorized attacker to execute code over a network. (CVE-2026-96230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over     a network. (CVE-2026-105016)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core     allows an unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core     allows an unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
474885	Alpine: multiple aspnetcore9-runtime packages, multiple dotnet-host packages: security update to 9.0.21-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
474885	Alpine: multiple aspnetcore9-runtime packages, multiple dotnet-host packages: security update to 9.0.21-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
474884	Alpine: multiple aspnetcore8-runtime packages, multiple dotnet-host packages: security update to 8.0.32-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
474884	Alpine: multiple aspnetcore8-runtime packages, multiple dotnet-host packages: security update to 8.0.32-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
366548	Security Update for Microsoft ASP.NET Core (October 2026)	Nessus	Windows	Local	critical
366547	Security Update for Microsoft .NET Core SDK (October 2026)	Nessus	Windows	Local	critical
366085	Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2026-92707

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical