MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments (CVE-2026-48517) | HOL Guard CVE