CVE-2026-92707 Common Vulnerabilities and Exposures

Upstream information

CVE-2026-92707 at MITRE

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
CVSS detail	CNA (GitHub)
Base Score	5.3
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	None
Availability Impact	Low
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

RHSA-2026:86168, published Thu Oct 22 15:24:11 UTC 2026
RHSA-2026:86169, published Thu Oct 22 15:24:14 UTC 2026
RHSA-2026:86170, published Thu Oct 22 15:07:36 UTC 2026
RHSA-2026:86171, published Thu Oct 22 15:24:14 UTC 2026
RHSA-2026:86172, published Thu Oct 22 15:24:11 UTC 2026
RHSA-2026:86192, published Thu Oct 22 15:24:13 UTC 2026
RHSA-2026:86193, published Thu Oct 22 15:24:14 UTC 2026
RHSA-2026:86195, published Thu Oct 22 15:24:12 UTC 2026
RHSA-2026:86594, published Thu Oct 22 15:24:13 UTC 2026
RHSA-2026:88422, published Sat Oct 24 15:07:26 UTC 2026

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 10	`aspnetcore-runtime-10.0 >= 10.0.13-1.el10_2` `aspnetcore-runtime-8.0 >= 8.0.32-1.el10_2` `aspnetcore-runtime-9.0 >= 9.0.21-1.el10_2` `aspnetcore-runtime-dbg-10.0 >= 10.0.13-1.el10_2` `aspnetcore-runtime-dbg-8.0 >= 8.0.32-1.el10_2` `aspnetcore-runtime-dbg-9.0 >= 9.0.21-1.el10_2` `aspnetcore-targeting-pack-10.0 >= 10.0.13-1.el10_2` `aspnetcore-targeting-pack-8.0 >= 8.0.32-1.el10_2` `aspnetcore-targeting-pack-9.0 >= 9.0.21-1.el10_2` `dotnet-apphost-pack-10.0 >= 10.0.13-1.el10_2` `dotnet-apphost-pack-8.0 >= 8.0.32-1.el10_2` `dotnet-apphost-pack-9.0 >= 9.0.21-1.el10_2` `dotnet-host >= 10.0.13-1.el10_2` `dotnet-hostfxr-10.0 >= 10.0.13-1.el10_2` `dotnet-hostfxr-8.0 >= 8.0.32-1.el10_2` `dotnet-hostfxr-9.0 >= 9.0.21-1.el10_2` `dotnet-runtime-10.0 >= 10.0.13-1.el10_2` `dotnet-runtime-8.0 >= 8.0.32-1.el10_2` `dotnet-runtime-9.0 >= 9.0.21-1.el10_2` `dotnet-runtime-dbg-10.0 >= 10.0.13-1.el10_2` `dotnet-runtime-dbg-8.0 >= 8.0.32-1.el10_2` `dotnet-runtime-dbg-9.0 >= 9.0.21-1.el10_2` `dotnet-sdk-10.0 >= 10.0.113-1.el10_2` `dotnet-sdk-10.0-source-built-artifacts >= 10.0.113-1.el10_2` `dotnet-sdk-8.0 >= 8.0.132-1.el10_2` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.132-1.el10_2` `dotnet-sdk-9.0 >= 9.0.122-1.el10_2` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.122-1.el10_2` `dotnet-sdk-aot-10.0 >= 10.0.113-1.el10_2` `dotnet-sdk-aot-9.0 >= 9.0.122-1.el10_2` `dotnet-sdk-dbg-10.0 >= 10.0.113-1.el10_2` `dotnet-sdk-dbg-8.0 >= 8.0.132-1.el10_2` `dotnet-sdk-dbg-9.0 >= 9.0.122-1.el10_2` `dotnet-targeting-pack-10.0 >= 10.0.13-1.el10_2` `dotnet-targeting-pack-8.0 >= 8.0.32-1.el10_2` `dotnet-targeting-pack-9.0 >= 9.0.21-1.el10_2` `dotnet-templates-10.0 >= 10.0.113-1.el10_2` `dotnet-templates-8.0 >= 8.0.132-1.el10_2` `dotnet-templates-9.0 >= 9.0.122-1.el10_2` `netstandard-targeting-pack-2.1 >= 9.0.122-1.el10_2`	Patchnames: RHSA-2026:86168 (x86_64) RHSA-2026:86172 (x86_64) RHSA-2026:86195 (x86_64)
SUSE Liberty Linux 8	`aspnetcore-runtime-10.0 >= 10.0.13-1.el8_10` `aspnetcore-runtime-8.0 >= 8.0.32-2.el8_10` `aspnetcore-runtime-9.0 >= 9.0.21-1.el8_10` `aspnetcore-runtime-dbg-10.0 >= 10.0.13-1.el8_10` `aspnetcore-runtime-dbg-8.0 >= 8.0.32-2.el8_10` `aspnetcore-runtime-dbg-9.0 >= 9.0.21-1.el8_10` `aspnetcore-targeting-pack-10.0 >= 10.0.13-1.el8_10` `aspnetcore-targeting-pack-8.0 >= 8.0.32-2.el8_10` `aspnetcore-targeting-pack-9.0 >= 9.0.21-1.el8_10` `dotnet >= 10.0.113-1.el8_10` `dotnet-apphost-pack-10.0 >= 10.0.13-1.el8_10` `dotnet-apphost-pack-8.0 >= 8.0.32-2.el8_10` `dotnet-apphost-pack-9.0 >= 9.0.21-1.el8_10` `dotnet-hostfxr-10.0 >= 10.0.13-1.el8_10` `dotnet-hostfxr-8.0 >= 8.0.32-2.el8_10` `dotnet-hostfxr-9.0 >= 9.0.21-1.el8_10` `dotnet-runtime-10.0 >= 10.0.13-1.el8_10` `dotnet-runtime-8.0 >= 8.0.32-2.el8_10` `dotnet-runtime-9.0 >= 9.0.21-1.el8_10` `dotnet-runtime-dbg-10.0 >= 10.0.13-1.el8_10` `dotnet-runtime-dbg-8.0 >= 8.0.32-2.el8_10` `dotnet-runtime-dbg-9.0 >= 9.0.21-1.el8_10` `dotnet-sdk-10.0 >= 10.0.113-1.el8_10` `dotnet-sdk-10.0-source-built-artifacts >= 10.0.113-1.el8_10` `dotnet-sdk-8.0 >= 8.0.132-2.el8_10` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.132-2.el8_10` `dotnet-sdk-9.0 >= 9.0.122-1.el8_10` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.122-1.el8_10` `dotnet-sdk-aot-10.0 >= 10.0.113-1.el8_10` `dotnet-sdk-aot-9.0 >= 9.0.122-1.el8_10` `dotnet-sdk-dbg-10.0 >= 10.0.113-1.el8_10` `dotnet-sdk-dbg-8.0 >= 8.0.132-2.el8_10` `dotnet-sdk-dbg-9.0 >= 9.0.122-1.el8_10` `dotnet-targeting-pack-10.0 >= 10.0.13-1.el8_10` `dotnet-targeting-pack-8.0 >= 8.0.32-2.el8_10` `dotnet-targeting-pack-9.0 >= 9.0.21-1.el8_10` `dotnet-templates-10.0 >= 10.0.113-1.el8_10` `dotnet-templates-8.0 >= 8.0.132-2.el8_10` `dotnet-templates-9.0 >= 9.0.122-1.el8_10` `netstandard-targeting-pack-2.1 >= 9.0.122-1.el8_10`	Patchnames: RHSA-2026:86170 (x86_64) RHSA-2026:86192 (x86_64) RHSA-2026:86594 (x86_64)
SUSE Liberty Linux 9.6 EMS	`aspnetcore-runtime-8.0 >= 8.0.32-1.el9_6` `aspnetcore-runtime-9.0 >= 9.0.21-1.el9_6` `aspnetcore-runtime-dbg-8.0 >= 8.0.32-1.el9_6` `aspnetcore-runtime-dbg-9.0 >= 9.0.21-1.el9_6` `aspnetcore-targeting-pack-8.0 >= 8.0.32-1.el9_6` `aspnetcore-targeting-pack-9.0 >= 9.0.21-1.el9_6` `dotnet-apphost-pack-8.0 >= 8.0.32-1.el9_6` `dotnet-apphost-pack-9.0 >= 9.0.21-1.el9_6` `dotnet-host >= 9.0.21-1.el9_6` `dotnet-hostfxr-8.0 >= 8.0.32-1.el9_6` `dotnet-hostfxr-9.0 >= 9.0.21-1.el9_6` `dotnet-runtime-8.0 >= 8.0.32-1.el9_6` `dotnet-runtime-9.0 >= 9.0.21-1.el9_6` `dotnet-runtime-dbg-8.0 >= 8.0.32-1.el9_6` `dotnet-runtime-dbg-9.0 >= 9.0.21-1.el9_6` `dotnet-sdk-8.0 >= 8.0.132-1.el9_6` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.132-1.el9_6` `dotnet-sdk-9.0 >= 9.0.122-1.el9_6` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.122-1.el9_6` `dotnet-sdk-aot-9.0 >= 9.0.122-1.el9_6` `dotnet-sdk-dbg-8.0 >= 8.0.132-1.el9_6` `dotnet-sdk-dbg-9.0 >= 9.0.122-1.el9_6` `dotnet-targeting-pack-8.0 >= 8.0.32-1.el9_6` `dotnet-targeting-pack-9.0 >= 9.0.21-1.el9_6` `dotnet-templates-8.0 >= 8.0.132-1.el9_6` `dotnet-templates-9.0 >= 9.0.122-1.el9_6` `netstandard-targeting-pack-2.1 >= 9.0.122-1.el9_6`	Patchnames: RHSA-2026:88422 (x86_64) RHSA-2026:89735 (x86_64)
SUSE Liberty Linux 9	`aspnetcore-runtime-10.0 >= 10.0.13-1.el9_8` `aspnetcore-runtime-8.0 >= 8.0.32-1.el9_8` `aspnetcore-runtime-9.0 >= 9.0.21-1.el9_8` `aspnetcore-runtime-dbg-10.0 >= 10.0.13-1.el9_8` `aspnetcore-runtime-dbg-8.0 >= 8.0.32-1.el9_8` `aspnetcore-runtime-dbg-9.0 >= 9.0.21-1.el9_8` `aspnetcore-targeting-pack-10.0 >= 10.0.13-1.el9_8` `aspnetcore-targeting-pack-8.0 >= 8.0.32-1.el9_8` `aspnetcore-targeting-pack-9.0 >= 9.0.21-1.el9_8` `dotnet-apphost-pack-10.0 >= 10.0.13-1.el9_8` `dotnet-apphost-pack-8.0 >= 8.0.32-1.el9_8` `dotnet-apphost-pack-9.0 >= 9.0.21-1.el9_8` `dotnet-host >= 10.0.13-1.el9_8` `dotnet-hostfxr-10.0 >= 10.0.13-1.el9_8` `dotnet-hostfxr-8.0 >= 8.0.32-1.el9_8` `dotnet-hostfxr-9.0 >= 9.0.21-1.el9_8` `dotnet-runtime-10.0 >= 10.0.13-1.el9_8` `dotnet-runtime-8.0 >= 8.0.32-1.el9_8` `dotnet-runtime-9.0 >= 9.0.21-1.el9_8` `dotnet-runtime-dbg-10.0 >= 10.0.13-1.el9_8` `dotnet-runtime-dbg-8.0 >= 8.0.32-1.el9_8` `dotnet-runtime-dbg-9.0 >= 9.0.21-1.el9_8` `dotnet-sdk-10.0 >= 10.0.113-1.el9_8` `dotnet-sdk-10.0-source-built-artifacts >= 10.0.113-1.el9_8` `dotnet-sdk-8.0 >= 8.0.132-1.el9_8` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.132-1.el9_8` `dotnet-sdk-9.0 >= 9.0.122-1.el9_8` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.122-1.el9_8` `dotnet-sdk-aot-10.0 >= 10.0.113-1.el9_8` `dotnet-sdk-aot-9.0 >= 9.0.122-1.el9_8` `dotnet-sdk-dbg-10.0 >= 10.0.113-1.el9_8` `dotnet-sdk-dbg-8.0 >= 8.0.132-1.el9_8` `dotnet-sdk-dbg-9.0 >= 9.0.122-1.el9_8` `dotnet-targeting-pack-10.0 >= 10.0.13-1.el9_8` `dotnet-targeting-pack-8.0 >= 8.0.32-1.el9_8` `dotnet-targeting-pack-9.0 >= 9.0.21-1.el9_8` `dotnet-templates-10.0 >= 10.0.113-1.el9_8` `dotnet-templates-8.0 >= 8.0.132-1.el9_8` `dotnet-templates-9.0 >= 9.0.122-1.el9_8` `netstandard-targeting-pack-2.1 >= 9.0.122-1.el9_8`	Patchnames: RHSA-2026:86169 (x86_64) RHSA-2026:86171 (x86_64) RHSA-2026:86193 (x86_64)

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.

Product(s)	Source package	State
Products under general support and receiving all security fixes.
SUSE Linux Enterprise Server 16.0	msgpack-c	Not affected
SUSE Linux Enterprise Server for SAP applications 16.0	msgpack-c	Not affected
openSUSE Leap 16.0	msgpack-c	Not affected

SUSE Timeline for this CVE

CVE page created: Thu Oct 22 11:51:00 2026
CVE page last modified: Fri Oct 30 12:55:28 2026