CVE-2026-48512

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A vulnerability (CVE-2026-48512) exists in the JSON conversion APIs of the MessagePack library, where multiple recursion paths lack consistent depth enforcement. MessagePackSerializer.ConvertFromJson and its FromJsonCore() helper recurse over nested JSON arrays and objects without consulting MessagePackSecurity.MaximumObjectGraphDepth; TinyJsonReader.ReadNextToken() recursively consumes runs of comma and colon separator characters, spending one stack frame per character; and the typeless ext-100 branch of MessagePackSerializer.ConvertToJson calls ToJsonCore() without applying the depth check the same function applies to arrays and maps. Each path allows a remote attacker to supply crafted JSON or typeless-extension data that exhausts the process stack and triggers an uncatchable StackOverflowException, resulting in Denial of Service.

Per CWE-674: Uncontrolled Recursion, Uncontrolled Recursion is defined as a product not properly controlling the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

This issue affects all v2 releases before 2.5.301 and v3 releases from 3.0.0 up to but not including 3.1.7 of MessagePack-CSharp. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack-CSharp (MessagePack for C#)
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the JSON conversion APIs of the MessagePack package. Three distinct code paths recurse on attacker-controlled input without enforcing a depth limit. First, MessagePackSerializer.ConvertFromJson delegates to FromJsonCore(), which descends into nested JSON arrays and objects with one stack frame per level and never consults MessagePackSecurity.MaximumObjectGraphDepth, so deeply nested JSON overflows the stack. Second, TinyJsonReader.ReadNextToken() recurses when it encounters comma or colon separators, so even malformed JSON consisting of a long run of separator characters consumes one stack frame per character before structural validation can reject it. Third, MessagePackSerializer.ConvertToJson applies MessagePackSecurity.DepthStep(ref reader) when writing arrays and maps, but its typeless extension branch for ext-100 recursively calls ToJsonCore() without that step, so nested typeless extension wrappers bypass the depth guard. In each case the crafted input exhausts the call stack and raises a StackOverflowException, which cannot be caught in normal .NET execution and terminates the process instead of failing with a catchable parse or serialization exception. Because these paths never consult the configured depth limit, hardening with MessagePackSecurity.UntrustedData does not mitigate the issue.

This vulnerability has been present since at least MessagePack-CSharp 2.0 and likely earlier.

Steps To Reproduce

1. In an application that uses the MessagePack library, call MessagePackSerializer.ConvertFromJson with a JSON string consisting of tens of thousands of nested arrays, for example a long run of the [ character.
2. Observe that parsing the nested structure recurses once per nesting level, exhausting the call stack and raising an uncatchable StackOverflowException that terminates the process rather than a catchable parse exception.
3. The TinyJsonReader.ReadNextToken() and typeless ext-100 ConvertToJson paths can be triggered similarly, with a long run of separator characters or deeply nested typeless extension wrappers respectively.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)