GHSA-7rj2-5w9w-r9jx

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. In NES for .NET 6, ASP.NET Core's SignalR MessagePack hub protocol depends on the MessagePack NuGet package, and HeroDevs moves that dependency forward when the library publishes security fixes.

A denial of service vulnerability (GHSA-7rj2-5w9w-r9jx) has been identified in the LZ4 block decompressor of MessagePack-CSharp, which allows a remote attacker to crash the process with a crafted compressed payload when an application deserializes untrusted data with LZ4 compression enabled.

Per CWE-190: Integer Overflow or Wraparound, the weakness is a product performing a calculation that can produce an integer overflow or wraparound when the logic assumes the result will always be larger than the original value.

This issue affects every NES for .NET 6 release up to and including 6.0.46, whose Microsoft.AspNetCore.SignalR.Protocols.MessagePack package depends on a MessagePack version below 2.5.307. Exposure is conditional: LZ4 compression is off by default and SignalR's default MessagePack options do not enable it, so only applications that opt into MessagePackCompression.Lz4Block or Lz4BlockArray for untrusted input are exposed.

Details

Module Info

• Product: MessagePack-CSharp, as used by ASP.NET Core SignalR in NES for .NET 6
• Affected packages: MessagePack (an opt-in NuGet dependency of Microsoft.AspNetCore.SignalR.Protocols.MessagePack, not part of the shared framework)
• Affected versions:
  
  • MessagePack < 2.5.307
  • MessagePack >= 3.0 < 3.1.11
  • Microsoft.AspNetCore.SignalR.Protocols.MessagePack >= 6.0.0 <= 6.0.46 (NES for .NET)
• Package manager: NuGet
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: MessagePack on NuGet
• Fixed in: NES for .NET 6.0.47 (MessagePack 2.5.307)

Vulnerability Info

This High-severity vulnerability is found in the MessagePack package in versions before 2.5.307 (v2) and 3.1.11 (v3) of MessagePack for C#. The LZ4 decompressor functions LZ4_uncompress_64 and LZ4_uncompress_32 build literal and match lengths by adding extension bytes to a 32-bit integer inside an unchecked block, which overrides the project's overflow checking. A crafted payload can wrap that length to a large negative value, which corrupts the decompressor's pointer arithmetic and causes an out-of-bounds memory access. On .NET 6 and later the resulting AccessViolationException cannot be caught, so the process terminates, and repeated payloads keep the service down. Enabling MessagePackSecurity.UntrustedData does not mitigate this issue, because it validates only the declared uncompressed length. The earlier LZ4 fix for CVE-2026-48109 added source bounds checks that this payload passes.

NES for .NET 6.0.47 moves the SignalR MessagePack protocol to MessagePack 2.5.307, which includes this fix along with the fixes for CVE-2026-92707 and GHSA-fx6j-x9m5-vmrf.

The advisory's lower bound is open (< 2.5.307), so the weakness is present in every 2.x release before the fix and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.307
  • MessagePack >= 3.1.11
• Disable LZ4 compression on paths that deserialize untrusted input until patched.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

zx (GitHub: @manus-pi) and @manus-use (reporters); Andrew Arnott from the MessagePack-CSharp project (remediation developer)