CVE-2026-92707

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. In NES for .NET 6, ASP.NET Core's SignalR MessagePack hub protocol depends on the MessagePack NuGet package, and HeroDevs moves that dependency forward when the library publishes security fixes.

A denial of service vulnerability (CVE-2026-92707) has been identified in the PrimitiveObjectFormatter of MessagePack-CSharp, which allows a remote attacker to force large memory allocations with a small payload of nested arrays when an application deserializes untrusted data as object. ASP.NET Core SignalR is one known way to reach it remotely.

Per CWE-1325: Improperly Controlled Sequential Memory Allocation, the weakness is a product that makes a separate memory allocation for each object in a group but does not properly limit the total memory consumed by all of them combined.

This issue affects every NES for .NET 6 release up to and including 6.0.46, whose Microsoft.AspNetCore.SignalR.Protocols.MessagePack package depends on a MessagePack version below 2.5.303. Remote exposure requires an application to enable the MessagePack hub protocol with AddMessagePackProtocol() and to have a reachable hub method with an object parameter. Microsoft's advisory lists Microsoft.AspNetCore.SignalR.Protocols.MessagePack 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Details

Module Info

• Product: MessagePack-CSharp, as used by ASP.NET Core SignalR in NES for .NET 6
• Affected packages: MessagePack (an opt-in NuGet dependency of Microsoft.AspNetCore.SignalR.Protocols.MessagePack, not part of the shared framework)
• Affected versions:
  
  • MessagePack < 2.5.303
  • MessagePack >= 3.0 < 3.1.9
  • Microsoft.AspNetCore.SignalR.Protocols.MessagePack >= 6.0.0 <= 6.0.46 (NES for .NET)
• Package manager: NuGet
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: MessagePack on NuGet
• Fixed in: NES for .NET 6.0.47 (MessagePack 2.5.307)

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in versions before 2.5.303 (v2) and 3.1.9 (v3) of MessagePack for C#. When PrimitiveObjectFormatter reads an array while deserializing into object, it allocates an object[] of the declared length before it enforces the configured maximum object-graph depth. The header check meant to stop oversized allocations only confirms that enough unread bytes remain, and nested array headers can all count the same trailing bytes. A small payload can therefore keep a disproportionate amount of memory live before the depth limit rejects it, and repeated requests cause severe memory pressure, heavy garbage collection, or process termination.

NES for .NET 6.0.47 moves the SignalR MessagePack protocol to MessagePack 2.5.307, which carries this fix along with the fixes for GHSA-fx6j-x9m5-vmrf and GHSA-7rj2-5w9w-r9jx. Blazor Server compiles its own copy of MessagePack's reader into the ASP.NET Core shared framework. HeroDevs investigation found the vulnerable formatter is not reachable through that copy, and 6.0.47 updates it anyway.

The advisory's lower bound is open (< 2.5.303), so the weakness is present in every 2.x release before the fix and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.303
  • MessagePack >= 3.1.9
  • .NET / ASP.NET Core >= 8.0.32, >= 9.0.21, or >= 10.0.13
• Replace object parameters on hub methods reachable over the MessagePack protocol with concrete types until patched.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Andrew Arnott from the MessagePack-CSharp project (remediation developer). Microsoft's advisory credits an anonymous reporter.