CVE-2026-48517— MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MessagePack-CSharp | MessagePack-CSharp | >= 3.0, < 3.1.7 | affected |
< 2.5.301 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48517
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Source: CVE Program / CVE List V5
Vulnerability Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Vulnerability Title
MessagePack-CSharp 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MessagePack-CSharp MessagePack-CSharp是MessagePack-CSharp团队的一款消息序列化工具。 MessagePack-CSharp 2.5.301之前版本和3.1.7之前版本存在安全漏洞，该漏洞源于无类型反序列化操作中未递归检查数组元素类型或泛型类型参数，导致被屏蔽的危险类型可以通过数组或构造的泛型类型绕过安全检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MessagePack-CSharp | MessagePack-CSharp | >= 3.0, < 3.1.7 | - |
II. Public POCs for CVE-2026-48517
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48517
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48517 (1)
Same Patch Batch · MessagePack-CSharp · 2026-06-22 · 12 CVEs total
| CVE-2026-48109 | 8.2 HIGH | MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after derefer |
| CVE-2026-48506 | 7.5 HIGH | MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object gr |
| CVE-2026-48516 | MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer setting | |
| CVE-2026-48511 | MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrus | |
| CVE-2026-48513 | MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement | |
| CVE-2026-48512 | MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement | |
| CVE-2026-48502 | MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the proce | |
| CVE-2026-48509 | MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTT | |
| CVE-2026-48510 | MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths | |
| CVE-2026-48515 | MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions | |
| CVE-2026-48514 | MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length |
IV. Related Vulnerabilities
Same product: MessagePack-CSharp
- CVE-2026-48109
MessagePack-CSharp: LZ4 decompression may fail with AccessVi - CVE-2026-48502
MessagePack-CSharp: Denial of service vulnerabilities can sw - CVE-2026-48506
MessagePack-CSharp: MessagePackReader.Skip can recurse witho - CVE-2026-48509
MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter d - CVE-2026-48510
MessagePack-CSharp: LZ4 decompression allocates from unbound
Same vendor: MessagePack-CSharp
- CVE-2026-48109
MessagePack-CSharp: LZ4 decompression may fail with AccessVi - CVE-2026-48502
MessagePack-CSharp: Denial of service vulnerabilities can sw - CVE-2026-48506
MessagePack-CSharp: MessagePackReader.Skip can recurse witho - CVE-2026-48509
MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter d - CVE-2026-48510
MessagePack-CSharp: LZ4 decompression allocates from unbound
Same weakness: CWE-470
- CVE-2026-17593
Nexus Repository - Arbitrary Class Instantiation via Unsafe - CVE-2026-64663
Statamic: Unsafe method invocation via Antlers template reso - CVE-2026-8400
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphe - CVE-2026-6020
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitra - CVE-2026-53666
React Router: Arbitrary Constructor Injection via deserializ
V. Comments for CVE-2026-48517
No comments yet