{"action":"Upgrade Nerdbank.MessagePack to 1.1.78 or later.","affected":[{"fixed":"1.1.78","introduced":"0"}],"component":"Nerdbank.MessagePack","cve_ids":[],"ecosystem":"NuGet","exploited":false,"fixed_versions":["1.1.78"],"ghsa_id":"GHSA-qjvr-435c-5fjh","id":"tcs_01M5N8YA4AB7BX1X837WVK8GRV","modified_at":"2026-05-29T20:00:14.500983137Z","published_at":"2026-05-29T19:55:09Z","references":["https://osv.dev/vulnerability/GHSA-qjvr-435c-5fjh","https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-qjvr-435c-5fjh","https://github.com/AArnott/Nerdbank.MessagePack/commit/6f19387a3d1322aea880ce3f8db2cfd0de195e12","https://github.com/AArnott/Nerdbank.MessagePack"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qjvr-435c-5fjh","url":"https://osv.dev/vulnerability/GHSA-qjvr-435c-5fjh"}],"summary":"Nerdbank.MessagePack has a memory amplification DoS in collection deserialization"}