{"items":[{"id":"CVE-2026-92707","published":"2026-10-15T18:35:49.074Z","updated":"2026-10-15T20:12:15.468Z","title":"MessagePack: Nested arrays can blow past buffer length limits","severity":"MEDIUM","score":5.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2026-48109","published":"2026-06-22T21:19:54.234Z","updated":"2026-06-23T12:14:29.046Z","title":"MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input","severity":"HIGH","score":8.2,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2026-48502","published":"2026-06-22T21:18:29.190Z","updated":"2026-06-23T15:05:33.595Z","title":"MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows","severity":"HIGH","score":8.2,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-48506","published":"2026-06-22T21:17:35.305Z","updated":"2026-06-23T12:13:55.675Z","title":"MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth","severity":"HIGH","score":7.5,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2026-48509","published":"2026-06-22T21:16:50.034Z","updated":"2026-06-25T15:02:55.701Z","title":"MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-48510","published":"2026-06-22T21:16:04.527Z","updated":"2026-06-25T15:05:31.713Z","title":"MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48511","published":"2026-06-22T21:14:54.127Z","updated":"2026-06-25T15:08:00.418Z","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48512","published":"2026-06-22T21:14:20.241Z","updated":"2026-06-25T15:16:38.766Z","title":"MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48513","published":"2026-06-22T21:12:43.104Z","updated":"2026-06-25T15:17:24.126Z","title":"MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48514","published":"2026-06-22T21:11:35.224Z","updated":"2026-06-25T15:23:26.175Z","title":"MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48515","published":"2026-06-22T21:10:39.110Z","updated":"2026-06-25T15:51:25.988Z","title":"MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48516","published":"2026-06-22T21:09:51.787Z","updated":"2026-06-25T15:54:33.529Z","title":"MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-48517","published":"2026-06-22T21:03:30.437Z","updated":"2026-06-25T15:55:22.519Z","title":"MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments","severity":"MEDIUM","score":6.3,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2024-48924","published":"2024-10-17T20:36:40.570Z","updated":"2024-10-18T17:20:11.062Z","title":"MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow","severity":"HIGH","score":8.7,"vendor":"MessagePack-CSharp","product":"MessagePack-CSharp","kev":false,"epss":0.00374,"kevAdded":null}]}