CVE-2026-48514

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A resource-allocation vulnerability (CVE-2026-48514) has been identified in the Unity unsafe blit formatter of MessagePack-CSharp, which allows a remote attacker to trigger excessive memory allocation by sending a small message that declares a very large array. This can exhaust available memory and terminate the process, resulting in a Denial of Service.

Per CWE-770: Allocation of Resources Without Limits or Throttling, Allocation of Resources Without Limits or Throttling is defined as a product that allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

This issue affects multiple versions of MessagePack-CSharp, including all version 2 releases prior to 2.5.301 and version 3 releases from 3.0.0 up to but not including 3.1.7. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack-CSharp
• Affected packages: MessagePack (Unity blit resolvers: UnityBlitResolver and UnityBlitWithPrimitiveArrayResolver)
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in versions prior to 2.5.301 and in version 3 releases before 3.1.7 of MessagePack-CSharp. The Unity blit formatter base type reads an attacker-controlled byte length from a MessagePack extension payload and allocates an array of that size before validating the length against the extension header or the number of bytes actually remaining in the input. The outer extension header is bounded by the available input, but that bound is never applied to the inner byte length prior to allocation, so a very small payload can request a very large array allocation.

The vulnerable path is reached only through the Unity blit resolvers, UnityBlitResolver and UnityBlitWithPrimitiveArrayResolver, which route to *UnsafeBlitFormatterBase.Deserialize*. When such a resolver deserializes data received from an untrusted peer, a crafted extension payload declaring a large element count causes the formatter to allocate the corresponding array immediately, leading to excessive memory consumption and a possible out-of-memory condition or process termination on memory-constrained platforms.

This vulnerability has been present since at least MessagePack 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Avoid using the Unity blit resolvers (UnityBlitResolver or UnityBlitWithPrimitiveArrayResolver) on data received from untrusted peers; prefer safer resolvers or validate and size-limit messages before deserialization.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)