MessagePack-C# LZ4 Decompression DoS via Unbounded Output Length (CVE-2026-48510)

Vulnerability Overview Title: LZ4 decompression allocates from unbounded declared output lengths Description: When MessagePack-Cdeserializes an or payload, it reads the declared uncompressed length from the network and allocates the output buffer before validating whether the compressed data is valid. If the declared expansion ratio is reasonable, a small payload can claim a very large uncompressed length, forcing a large allocation before LZ4 decoding begins. Impact: Applications are affected when deserializing attacker-controlled MessagePack payloads that enable or . In the case of , an attacker-controlled integer is used to request a target span. In the case of , the uncompressed length of each block and their aggregate sum can be controlled by the attacker. With no upper limit, the declared output size can be disproportionate to the input size, leading to memory anomalies, process termination, or severe memory pressure. Affected Scope Affected Package: MessagePack (NuGet) Affected Versions: [0.2.5.300], [3.0.3.1.7] Fixed Versions: 2.5.301, 3.1.7 Remediation Patch: A patch is ready and will be released in a coordinated patch version. Upgrade Guide: 1. Upgrade MessagePack to the patch version of the release line. 2. Upgrade companion MessagePack packages within the same dependency graph to the coordinated patch version. 3. The patch should reject negative and excessive uncompressed length allocations and should limit the aggregate uncompressed size of block arrays, or expose and respect an appropriate maximum uncompressed length policy. Workarounds Workaround: Before the patch version is available, do not enable MessagePack-C#'s built-in LZ4 compression mode for untrusted inputs. If compression is required, enforce compression and uncompressed size limits prior to deserialization. References MESSAGEPACKC#-OPEN-004: LZ4 decompression allocation from unbounded uncompressed length MESSAGEPACKC#-011: duplicate decompression bomb finding CWE-400: Improper Handling of Highly Compressed Data CWE-770: Allocation of Resources Without Limits or Throttling Additional Information CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: Low - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2026-48510 Weaknesses: - CWE-400 - CWE-770 Credits: AAmott (Remediation developer)

Goal Reached Thanks to every supporter — we hit 100%!

MessagePack-C# LZ4 Decompression DoS via Unbounded Output Length (CVE-2026-48510)

More from this source