CVE-2026-48513 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.
A vulnerability exists in MessagePack for C# versions prior to 2.5.301 and 3.1.7, where runtime-generated union deserializers from DynamicUnionResolver fail to properly manage object graph depth during recursive deserialization. This oversight allows union deserialization to bypass maximum depth restrictions, potentially leading to a denial-of-service condition via a StackOverflowException. The issue arises when deserializing untrusted data into union types handled by the dynamic resolver, as the deserializer skips depth accounting for unknown union keys, leaving applications vulnerable to deep nesting attacks.
Users are advised to upgrade MessagePack to version 2.5.301 or 3.1.7. Additionally, upgrade any companion MessagePack packages in the same dependency graph to the coordinated patched versions. Until a patch is applied, avoid deserializing untrusted payloads into dynamically resolved union types and consider using source-generated formatters that include depth checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |