{"metadata": {"vulnerability": "CVE-2026-92707", "count": 19, "kinds": {"milestone": 6, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-16T16:22:31.542Z", "date_only": false, "value": "2026-09-16T16:22:31.542Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-92707", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-19T03:06:12.491Z", "date_only": false, "value": "2026-09-19T03:06:12.491711Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/startdebugging.bsky.social/post/3mvtpademj227", "record": "cve-2026-92707", "field": "creation_timestamp", "uuid": "d1bdf816-0b4f-47c5-b7db-e3edae482e65", "content": "A 32 KiB MessagePack payload allocated 120 MiB before the depth limit fired. 3.1.9 and 2.5.303 fix it; SignalR needs a manual pin.\nhttps://startdebugging.net/2026/09/messagepack-3-1-9-fixes-nested-array-memory-amplification-cve-2026-92707/?utm_source=bluesky&utm_medium=social&utm_campaign=auto", "url": "https://bsky.app/profile/startdebugging.bsky.social/post/3mvtpademj227"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T20:00:00Z", "date_only": false, "value": "2026-10-13T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-october-2026", "record": "CVE-2026-92707", "field": "creation_timestamp", "uuid": "3037e429-6de3-4c7c-82eb-1970c0e39991", "url": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-october-2026"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:20:40Z", "date_only": false, "value": "2026-10-14T00:20:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-14/Microsoft-retter-rekordmange-saarbarheder-i-oktober", "record": "CVE-2026-92707", "field": "creation_timestamp", "uuid": "734713b2-3320-42c9-9c00-a20c7b7ff371", "url": "https://www.cert.dk/news/2026-10-14/Microsoft-retter-rekordmange-saarbarheder-i-oktober"}, {"timestamp": "2026-10-15T18:35:46Z", "date_only": false, "value": "2026-10-15T18:35:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QHRR-8Q5H-9Q3H", "record": "GHSA-QHRR-8Q5H-9Q3H", "field": "published"}, {"timestamp": "2026-10-15T18:35:46Z", "date_only": false, "value": "2026-10-15T18:35:46Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QHRR-8Q5H-9Q3H", "record": "GHSA-QHRR-8Q5H-9Q3H", "field": "modified"}, {"timestamp": "2026-10-15T18:35:49.074Z", "date_only": false, "value": "2026-10-15T18:35:49.074Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92707", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T18:35:49.074Z", "date_only": false, "value": "2026-10-15T18:35:49.074Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-92707", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:49:59.992Z", "date_only": false, "value": "2026-10-15T18:49:59.992428Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117446423311937325", "record": "CVE-2026-92707", "field": "creation_timestamp", "uuid": "4df467be-efb6-429e-bc7b-5eed6f139d0b", "content": "CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.\nhttps://www.cve.org/CVERecord?id=CVE-2026-92707https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhrr-8q5h-9q3hhttps://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/7fd78bbf3476e03beae8b0f7a521125525a8a64ahttps://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/95b63fca4f7097d3cac12d1a95286af4b4bbf02chttps://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.303https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v3.1.9#MessagePack-CSharp#CVE_2026_92707#bot", "url": "https://infosec.exchange/users/cve/statuses/117446423311937325"}, {"timestamp": "2026-10-15T19:17:48.703Z", "date_only": false, "value": "2026-10-15T19:17:48.703", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92707", "record": "FKIE_CVE-2026-92707", "field": "published"}, {"timestamp": "2026-10-15T20:10:28.719Z", "date_only": false, "value": "2026-10-15T20:10:28.719217Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92707", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T20:10:28.719Z", "date_only": false, "value": "2026-10-15T20:10:28.719217Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92707", "record": "FKIE_CVE-2026-92707", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T20:12:15.468Z", "date_only": false, "value": "2026-10-15T20:12:15.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-92707", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T20:12:15.468Z", "date_only": false, "value": "2026-10-15T20:12:15.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92707", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T20:17:15.983Z", "date_only": false, "value": "2026-10-15T20:17:15.983", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92707", "record": "FKIE_CVE-2026-92707", "field": "lastModified"}]}