CVE-2026-48513

Katalog CVE

CVSS 7.5 · High EPSS 0,40%

Kerentanan Uncontrolled Recursion pada messagepack. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh mitigasi · advisory vendor