CVE-2026-48515

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. NES HeroDevs Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A denial of service vulnerability (CVE-2026-48515) has been identified in MessagePack for C#, where the multi-dimensional array formatters read the per-dimension lengths directly from an incoming payload and allocate the target array before validating that the product of those dimensions matches the encoded element count. This allows a remote, unauthenticated attacker to send a small crafted payload that declares very large dimensions with an empty or tiny element array, forcing a large heap allocation and denial of service before any element data is validated.

Per CWE-770: Allocation of Resources Without Limits or Throttling, Allocation of Resources Without Limits or Throttling is defined as a product that allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

This issue affects versions of MessagePack for C# prior to 2.5.301 on the v2 line and prior to 3.1.7 on the v3 line. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: Any .NET application that uses the MessagePack NuGet package to deserialize untrusted MessagePack payloads into types containing a multi-dimensional array (T[,], T[,,], or T[,,,]).
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in versions of MessagePack for C# prior to 2.5.301 on the v2 line and prior to 3.1.7 on the v3 line. The multi-dimensional array formatters *TwoDimensionalArrayFormatter*, *ThreeDimensionalArrayFormatter*, and *FourDimensionalArrayFormatter* read a guarded element-array header and then read the per-dimension lengths (*iLength*, *jLength*, and so on) directly from the payload, allocating the target *T[,]*, *T[,,]*, or *T[,,,]* before validating that the product of the declared dimensions matches the encoded element count.

Because the allocation happens before the dimension product is checked against the guarded element count, a small payload can declare very large dimensions while supplying an empty or tiny element array. Deserializing such a payload forces a large heap allocation, and the cost of zero-initializing the oversized array, before the mismatch is ever detected. The result is out-of-memory exceptions, large object heap pressure, or process and container termination on memory-constrained hosts, reachable by any code path that deserializes an untrusted MessagePack payload into a type containing a multi-dimensional array. This vulnerability has been present since at least MessagePack for C# 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)