CVE-2026-92707: Medium severity MessagePack MessagePack-CSharp vulnerability
Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network.
Other sources
MessagePack-CSharp Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.32 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0-rc.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.303 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.13
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems that use the affected MessagePack-CSharp functionality and can be reached over a network are exposed. The attack vector is network-based.
Does an attacker need credentials or user interaction?
No. The vulnerability is rated as requiring no privileges and no user interaction, with low attack complexity.
What is the expected security impact?
The reported impact is denial of service with a low availability impact. No confidentiality or integrity impact is indicated.