Skip to content

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

High severity GitHub Reviewed Published Jun 9, 2026 in MessagePack-CSharp/MessagePack-CSharp

Package

nuget MessagePack (NuGet)

Affected versions

< 2.5.301
>= 3.0.214-rc.1, < 3.1.7

Patched versions

2.5.301
3.1.7

Description

Impact

A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray.

The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure.

This issue affects applications that deserialize untrusted data while LZ4 compression is enabled.

Patches

The v2 versions are patched as of 2.5.301.
The v3 versions are patched as of 3.1.7.

Workarounds

Instead of upgrading, an application may take the following precautions:

  1. Disable LZ4 compression for untrusted input paths (Lz4Block, Lz4BlockArray).
  2. Only accept compressed payloads from strongly trusted producers.
  3. Isolate deserialization in a separate process/container with restart supervision to limit availability impact.

Resources

  • MESSAGEPACKCSHARP-010

References

@AArnott AArnott published to MessagePack-CSharp/MessagePack-CSharp Jun 9, 2026
Published to the GitHub Advisory Database Jun 11, 2026
Reviewed Jun 11, 2026

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(31st percentile)

Weaknesses

No CWEs

CVE ID

CVE-2026-48109

GHSA ID

GHSA-hv8m-jj95-wg3x

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.
⚡