Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Oct 28, 2026Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service throughCVE-2026-106972 · Other software · reported by MITREHigh 7.5
Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crCVE-2026-106971 · Other software · reported by MITRE
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026MessagePack is the serializer implementation for Python msgpack.org.CVE-2026-114613 · Other software · msgpack · reported by GitHubHigh 7.5
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
- Product
- msgpack-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-92707 · Other software · MessagePack-CSharp · reported by GitHubMedium 5.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026MessagePack for Ruby is an implementation of the MessagePack binary serialization format.CVE-2026-54522 · Other software · msgpack · reported by GitHubLow 2.1
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.
- Product
- msgpack-ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026MessagePack is the serializer implementation for Python msgpack.org.CVE-2026-57585 · Other software · msgpack · reported by GitHubHigh 7.5
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Product
- msgpack-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48517 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48516 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48515 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the target multi-dimensional array happens before the dimensions are checked against that element count. A small payload can therefore declare large dimensions, provide an empty or tiny inner array, and cause a large heap allocation before element data is validated. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48514 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used to constrain the inner byteLength before allocation. A very small payload can therefore request a very large T[] allocation. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48513 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48512 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48511 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48510 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48509 · Other software · MessagePack-CSharp · reported by GitHubMedium 6.3
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48506 · Other software · MessagePack-CSharp · reported by GitHubHigh 7.5
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing the reader depth or calling the configured depth checks. This bypasses MessagePackSecurity.MaximumObjectGraphDepth, the library's documented protection against deeply nested object graphs. Many generated and dynamic formatters call reader.Skip() when they encounter unknown map keys, unknown array members, ignored fields, or data that should be skipped for forward compatibility. A deeply nested value in one of these skipped positions can therefore cause unbounded recursion and an uncatchable StackOverflowException. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48502 · Other software · MessagePack-CSharp · reported by GitHubHigh 8.2
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MessagePack for C# is a MessagePack serializer for C#.CVE-2026-48109 · Other software · MessagePack-CSharp · reported by GitHubHigh 8.2
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library.CVE-2026-44375 · Other software · AArnott · reported by GitHubHigh 7.5
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.
- Product
- Nerdbank.MessagePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026MessagePack for Java is a serializer implementation for Java.CVE-2026-21452 · Other software · msgpack · reported by GitHubHigh 7.5
MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deseri
- Product
- msgpack-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker thaCVE-2024-48924 · Other software · MessagePack-CSharp · reported by GitHubHigh 8.7
### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized. This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability. ### Patches The following steps are required to mitigate this risk. 1. Upgrade to a version of the library where a fix is available. 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data. ### Workarounds If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows: 1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer<T>` method to provide a collision-resistant hash function of your own
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023msgpackr is a fast MessagePack NodeJS/JavaScript implementation.CVE-2023-52079 · Other software · kriszyp · reported by GitHubMedium 6.8
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
- Product
- msgpackr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45693 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45692 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45691 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45690 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Jan 31, 2020MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack oCVE-2020-5234 · Other software · neuecc · reported by GitHubMedium 4.8
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
- Product
- MessagePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.