Came across something in DevSuite/Assets/packages.config around line 1 that looked worth flagging.
The project uses MessagePack (v3.1.4), which contains a critical flaw (CVE-2026-48109) in its optional LZ4 decompression path. The decoder uses a deprecated fast‑decompression algorithm that lacks proper bounds checking, allowing a crafted MessagePack payload to cause out‑of‑bounds reads. An attacker can trigger an AccessViolationException, leading to a denial‑of‑service, and under certain conditions may also leak memory contents. This is a HIGH‑severity issue and must be remediated by upgrading to a version where the decoder has been rewritten with safe bounds checks (≥ 3.1.7 or ≥ 2.5.301).
Something like this might fix it:
*** Begin Patch
*** Update File: DevSuite/Assets/packages.config
@@
- <package id="MessagePack" version="3.1.4" targetFramework="net48" />
+ <package id="MessagePack" version="3.1.7" targetFramework="net48" />
*** End Patch
For reference: rule CVE-2026-48109. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
DevSuite/Assets/packages.configaround line 1 that looked worth flagging.The project uses MessagePack (v3.1.4), which contains a critical flaw (CVE-2026-48109) in its optional LZ4 decompression path. The decoder uses a deprecated fast‑decompression algorithm that lacks proper bounds checking, allowing a crafted MessagePack payload to cause out‑of‑bounds reads. An attacker can trigger an AccessViolationException, leading to a denial‑of‑service, and under certain conditions may also leak memory contents. This is a HIGH‑severity issue and must be remediated by upgrading to a version where the decoder has been rewritten with safe bounds checks (≥ 3.1.7 or ≥ 2.5.301).
Something like this might fix it:
For reference: rule
CVE-2026-48109. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.