{"action":"Upgrade MessagePack to 2.5.303 (2.x) or 3.1.9 (3.x) or later.","affected":[{"fixed":"2.5.303","introduced":"0"},{"fixed":"3.1.9","introduced":"3.0.0"}],"component":"MessagePack","cve_ids":["CVE-2026-92707"],"ecosystem":"NuGet","epss":0.00678,"exploited":false,"fixed_versions":["2.5.303","3.1.9"],"ghsa_id":"GHSA-qhrr-8q5h-9q3h","id":"tcs_01M5N8Y8N5622DAHQVC6E39B92","modified_at":"2026-10-15T18:45:11.655001723Z","published_at":"2026-10-15T18:35:46Z","references":["https://osv.dev/vulnerability/GHSA-qhrr-8q5h-9q3h","https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhrr-8q5h-9q3h","https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/7fd78bbf3476e03beae8b0f7a521125525a8a64a","https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/95b63fca4f7097d3cac12d1a95286af4b4bbf02c","https://github.com/MessagePack-CSharp/MessagePack-CSharp","https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.303","https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v3.1.9"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qhrr-8q5h-9q3h","url":"https://osv.dev/vulnerability/GHSA-qhrr-8q5h-9q3h"}],"summary":"MessagePack: Nested arrays can blow past buffer length limits"}