Messagepack

Vendor:

First CVE: Jan 31, 2020 · Active for 6 years

14

Total CVEs

Bottom 1%

4.7

Avg CVEs / Year

Bottom 1%

7.6

Avg CVSS

Higher Avg CVSS than 50% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Messagepack over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jan 31, 2020

6 years ago

Most Recent CVE

Jun 22, 2026

32 days ago

CVE Severity & Scoring

Messagepack14 CVEs

86%

All CVEs352,231 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network14 (100.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low14 (100.0%)

High0 (0.0%)

Unknown0 (0.0%)

User Interaction

None14 (100.0%)

Unknown0 (0.0%)

Required0 (0.0%)

Privileges Required

Low1 (7.1%)

High0 (0.0%)

None13 (92.9%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (14 CVEs).

14 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2026-48509CRITICAL MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which	Jun 22, 2026	9.1	36	NO	NO
CVE-2026-48109HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression mod	Jun 22, 2026	8.2	33	NO	NO
CVE-2026-48502HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled Messag	Jun 22, 2026	7.5	32	NO	NO
CVE-2026-48506HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing	Jun 22, 2026	7.5	31	NO	NO
CVE-2026-48510HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncomp	Jun 22, 2026	7.5	31	NO	NO
CVE-2026-48511HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<	Jun 22, 2026	7.5	30	NO	NO
CVE-2026-48512HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consist	Jun 22, 2026	7.5	30	NO	NO
CVE-2026-48513HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecu	Jun 22, 2026	7.5	30	NO	NO
CVE-2026-48515HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the	Jun 22, 2026	7.5	30	NO	NO
CVE-2026-48516HIGH MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TE	Jun 22, 2026	7.5	30	NO	NO

View all 14 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (14 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (14 CVEs).

Media Mentions

Signals from CVEs in this product scope (14 CVEs).

Top CNAs Publishing CVEs For Messagepack

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
2.0.94	1	6.5	1.6%
2.0.299	1	6.5	1.6%
2.0.270	1	6.5	1.6%
2.0.204	1	6.5	1.6%
2.0.123	1	6.5	1.6%
2.0.119	1	6.5	1.6%
2.0.110	1	6.5	1.6%