CVE-2026-48506

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A denial-of-service vulnerability (CVE-2026-48506) has been identified in MessagePack-CSharp, in which the MessagePackReader.Skip implementation descends into nested arrays and maps through unbounded recursion without incrementing the reader depth or consulting the configured MessagePackSecurity.MaximumObjectGraphDepth limit. This allows a remote, unauthenticated attacker to submit a deeply nested MessagePack payload that exhausts the call stack and terminates the process with an uncatchable StackOverflowException, resulting in Denial of Service.

Per CWE-674: Uncontrolled Recursion, Uncontrolled Recursion is defined as a product not properly controlling the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

This issue affects all MessagePack-CSharp v2 releases before 2.5.301 and v3 releases from 3.0.0 before 3.1.7, including the NES Essentials Plus MessagePack 2.5.192.x line before 2.5.192.2.

‍

Details

Module Info

• Product: MessagePack-CSharp, and any .NET application that deserializes untrusted MessagePack data with it.
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.2
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.2

Vulnerability Info

This High-severity vulnerability is found in the MessagePack package of MessagePack-CSharp. The MessagePackReader type skips over nested arrays and maps through recursive calls to TrySkip, descending one level of the call stack for every level of nesting in the incoming payload, and this skipping logic never consults the MessagePackSecurity.MaximumObjectGraphDepth limit that protects ordinary deserialization. Skipping is reached whenever a formatter encounters data it does not need, such as unknown map keys, unknown array members, ignored fields, or bytes kept for forward compatibility.

A remote, unauthenticated attacker who can reach a deserialization path can send a payload containing roughly one hundred thousand nested single-element arrays in a position the reader will skip, exhausting the call stack and triggering a StackOverflowException that cannot be caught and terminates the process. Because the recursive skip path bypasses the depth limit entirely, hardening deserialization with the MessagePackSecurity.UntrustedData setting does not mitigate this issue.

This vulnerability was introduced in 2019 with MessagePack-CSharp 2.0.

Steps To Reproduce

1. Reference the MessagePack package (any version below the fixed releases) and define a type whose formatter skips unrecognized data, for example a message contract that ignores unknown map keys during deserialization.
2. As a client, construct a MessagePack payload in which the value the reader will skip consists of roughly one hundred thousand nested single-element arrays.
3. Deserialize the crafted payload with MessagePackSerializer.Deserialize.
4. Observe that skipping the nested structure recurses once per nesting level until the call stack is exhausted, raising a StackOverflowException that cannot be caught and terminates the process.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack 2.5.301 or later on the v2 package line
  • MessagePack 3.1.7 or later on the v3 package line
• For NES-supported .NET deployments using the NES fork, upgrade to NES Essentials Plus MessagePack 2.5.192.2 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)