CVE-2026-92707
1 advisory.
NuGet/MessagePack CVE-2026-92707: medium 5.3
MessagePack: Nested arrays can blow past buffer length limits
Action: Upgrade MessagePack to 2.5.303 (2.x) or 3.1.9 (3.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.303 | - |
| 3.0.0 | 3.1.9 | - |
Fixed versions
| 2.5.303 | 3.1.9 |
Sources
- osv: GHSA-qhrr-8q5h-9q3h
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhrr-8q5h-9q3h
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/7fd78bbf3476e03beae8b0f7a521125525a8a64a
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/95b63fca4f7097d3cac12d1a95286af4b4bbf02c
- https://github.com/MessagePack-CSharp/MessagePack-CSharp
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.303
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v3.1.9
CVE-2026-92707 · published · modified · JSON