CVE-2026-48506 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing the reader depth or calling the configured depth checks. This bypasses MessagePackSecurity.MaximumObjectGraphDepth, the library's documented protection against deeply nested object graphs. Many generated and dynamic formatters call reader.Skip() when they encounter unknown map keys, unknown array members, ignored fields, or data that should be skipped for forward compatibility. A deeply nested value in one of these skipped positions can therefore cause unbounded recursion and an uncatchable StackOverflowException. This vulnerability is fixed in 2.5.301 and 3.1.7.
A vulnerability exists in MessagePack for C# versions prior to 2.5.301 and 3.1.7, where the MessagePackReader.TrySkip() method can recursively navigate through nested arrays and maps without properly managing the reader depth or applying the set depth limitations. This flaw circumvents the library's safeguard against excessively nested object structures. Many dynamic and generated formatters trigger the reader.Skip() method upon encountering unrecognized map keys, array members, ignored fields, or data meant to be skipped for forward compatibility. Consequently, a deeply nested value in these overlooked areas can lead to unbounded recursion, causing a StackOverflowException that cannot be caught. This vulnerability is particularly concerning for applications that deserialize untrusted MessagePack data, as it can be exploited during regular object deserialization when unknown members or extra values are present.
Users are advised to upgrade to MessagePack versions 2.5.301 or 3.1.7. Additionally, upgrade any companion MessagePack packages in the same dependency graph to the coordinated patched versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-vh6j-jc39-fggf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |