CVE-2026-48513

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A CWE-674: Uncontrolled Recursion vulnerability (CVE-2026-48513) has been identified in MessagePack-CSharp, in the union deserializers that DynamicUnionResolver emits at runtime. These deserializers do not participate in the library's maximum object graph depth enforcement, which allows a remote attacker to send a deeply nested payload behind an unknown union key that exhausts the call stack and crashes the process, resulting in Denial of Service.

Per CWE-674: Uncontrolled Recursion, Uncontrolled Recursion is defined as a product not properly controlling the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

This issue affects MessagePack v2 releases before 2.5.301 and v3 releases from 3.0.0 before 3.1.7. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack for C# (MessagePack-CSharp)
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package of MessagePack-CSharp. The deserializers that DynamicUnionResolver generates at runtime for [Union]-annotated types do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around the recursive deserialization and skip paths they emit. As a result, union deserialization does not consistently participate in the maximum object graph depth enforcement (MessagePackSecurity.MaximumObjectGraphDepth) that guards the library's other recursive formatter paths. When an emitted deserializer encounters an unknown union key, it calls reader.Skip() on attacker-controlled data with no enclosing depth step, so a payload consisting of deeply nested values behind an unknown union key drives recursion one stack frame per nesting level until the call stack is exhausted, raising a StackOverflowException that cannot be caught and terminates the process. Because this path never consults the depth limit, configuring MessagePackSecurity.UntrustedData does not mitigate the issue.

This vulnerability has been present since at least MessagePack 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)