6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48510

CVE-2026-48510: MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48510

CVE-2026-48510:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
MessagePack	nuget	< 2.5.301	2.5.301
MessagePack	nuget	>= 3.0, < 3.1.7	3.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unbounded memory allocation (CWE-409) that occurs during the decompression of LZ4 compressed payloads in MessagePack-CSharp. The advisory explicitly mentions the internal routine MessagePackSerializer.TryDecompress as the location of the flaw. To pinpoint the exact vulnerable code, I analyzed the changes between a vulnerable version and the patched version 2.5.301. The key fixing commit is 853429a0f438fcdc8a7ee3c158ee838f12a5be48, with the message "Guard LZ4 decompression length for CWE-409".

This commit modifies src/MessagePack.UnityClient/Assets/Scripts/MessagePack/MessagePackSerializer.cs. The patch changes the signature of the TryDecompress method to accept MessagePackSerializerOptions, which carries security limits. Crucially, it introduces a new method, ThrowIfInvalidLz4BlockLength, which is called to validate the declared uncompressedLength against a MaximumDecompressedSize before the memory for the decompressed data is allocated with writer.GetSpan(uncompressedLength). The absence of this check in prior versions is the root cause of the vulnerability, making TryDecompress the function where the vulnerability is triggered during runtime.

Vulnerable functions

MessagePack.MessagePackSerializer.TryDecompress

src/MessagePack.UnityClient/Assets/Scripts/MessagePack/MessagePackSerializer.cs

This function handles the decompression of LZ4 compressed data. In vulnerable versions, it reads the `uncompressedLength` from the message payload and directly uses it to allocate a destination buffer (`writer.GetSpan(uncompressedLength)`). An attacker could craft a message with a small compressed payload but a very large `uncompressedLength`, causing the application to attempt a huge memory allocation, leading to a Denial of Service (DoS) through an OutOfMemoryException.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.