CVE-2026-48517

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A typeless deserialization type-restriction bypass vulnerability (CVE-2026-48517) has been identified in MessagePack for C#, in which the ThrowIfDeserializingTypeIsDisallowed safety check inspects only the outer type it is given and never recurses into array element types or generic type arguments. This allows a blocked type wrapped in an array or a generic construct to bypass the configured type restrictions during typeless deserialization, after which the formatter machinery materializes a formatter for the restricted inner type.

Per CWE-502: Deserialization of Untrusted Data, Deserialization of Untrusted Data is defined as a product deserializing untrusted data without sufficiently verifying that the resulting data will be valid.

Per CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'), this weakness is defined as a product using external input with reflection to select which classes or code to use, but not sufficiently preventing the input from selecting improper classes or code.

This issue affects MessagePack for C# 2.x before 2.5.301 and 3.x from 3.0 before 3.1.7. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack for C# (MessagePack-CSharp)
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in versions before 2.5.301 (v2) and 3.1.7 (v3) of MessagePack for C#. When an application enables typeless deserialization, through MessagePackSerializer.Typeless, the TypelessContractlessStandardResolver, or object graphs that embed typeless members, the type name is read from the incoming payload and the library is expected to enforce the caller's allow/deny restrictions through MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed. That check validates only the outer Type passed to it. When the resolved type is an array or a generic type, the element type and the generic type arguments are never re-examined, so a restricted type wrapped as Foo[], List<T>, or Dictionary<K,V> passes the gate and the formatter machinery then materializes a formatter for the restricted inner type. Because the restriction is the intended safety boundary for typeless deserialization of untrusted input, this bypass allows attacker-influenced input to drive selection of otherwise-blocked types via reflection. Exploitation requires the application to opt into typeless deserialization of untrusted data and to rely on the type restrictions as its safety boundary, which is reflected in the Medium rating.

This vulnerability has been present since at least MessagePack for C# 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)