Detections
Analytics
SCA: security update for MessagePack (GHSA-2f33-pr97-265q)
medium Tenable Cloud Security Plugin ID 443929
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless
MessagePackInputFormatter() constructor uses default serializer options, which resolve to
MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for
ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can
expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to
mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is
fixed in 2.5.301 and 3.1.7. (CVE-2026-48509)
Solution
Update the MessagePack library and its related packages to version 2.5.301 or later.See Also
Plugin Details
Severity: Medium
ID: 443929
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 6/25/2026
Updated: 7/6/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.62
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C
CVSS Score Source: CVE-2026-48509
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.3
Threat Score: 1.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/25/2026
Vulnerability Publication Date: 6/22/2026
Reference Information
CVE: CVE-2026-48509
cwe: CWE-1188