EOL Fix Available | CVE-2026-48510

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. Herodevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A denial of service vulnerability (CVE-2026-48510) has been identified in MessagePack-CSharp, which allows attackers to force disproportionately large memory allocations when LZ4 compression is enabled. When the library decompresses Lz4Block or Lz4BlockArray payloads, it reads the declared uncompressed length from the wire and allocates an output buffer of that size before validating the compressed data or bounding the declared expansion. A small payload can therefore claim a very large uncompressed length and force a large allocation before LZ4 decoding begins, producing out-of-memory exceptions, process termination on constrained hosts, or severe memory pressure.

Per CWE-770: Allocation of Resources Without Limits or Throttling, Allocation of Resources Without Limits or Throttling is defined as a product that allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

This issue affects multiple versions of MessagePack-CSharp, including all v2 releases before 2.5.301 and v3 releases from 3.0.0 before 3.1.7, in applications that deserialize untrusted payloads with LZ4 compression enabled. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.2.

‍

Details

Module Info

Product: MessagePack-CSharp (the MessagePack NuGet serializer for .NET, also compiled into and referenced by ASP.NET Core SignalR and Blazor Server)
Affected packages: MessagePack
Affected versions:
- MessagePack < 2.5.301
- MessagePack >= 3.0.0 < 3.1.7
- NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.2
GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
Published packages: https://www.nuget.org/packages/MessagePack
Package manager: NuGet
Fixed in: NES Essentials Plus MessagePack 2.5.192.2

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in the LZ4 decompression path of MessagePack-CSharp. When a payload is serialized with MessagePackCompression.Lz4Block or MessagePackCompression.Lz4BlockArray, the compressed block is prefixed with the declared uncompressed length. On the read side, the library reads that declared length directly from the wire and allocates an output buffer of that size before it validates the compressed data or checks that the declared expansion ratio is plausible. Because the declared length is attacker-controlled and unbounded, a small compressed payload can claim a very large uncompressed length and force a correspondingly large allocation before any LZ4 decoding takes place. A remote or otherwise untrusted producer whose data reaches a deserializer with LZ4 compression enabled can repeatedly trigger these outsized allocations, exhausting available memory and causing out-of-memory exceptions, process termination on constrained hosts, or severe memory pressure and degraded availability. Applications that do not enable LZ4 compression are not exposed to this particular allocation path.

This vulnerability has been present since at least MessagePack 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- MessagePack >= 2.5.301
- MessagePack >= 3.1.7
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.2 or later.

‍