CVE-2026-48109 Overview
CVE-2026-48109 affects MessagePack for C#, a widely used MessagePack serializer for .NET applications. The vulnerability exists in the optional LZ4 decompression path used by the Lz4Block and Lz4BlockArray compression modes. The decoder relies on a deprecated fast-decompression algorithm that does not enforce a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token and length fields to trigger out-of-bounds reads from the compressed input buffer. The flaw is fixed in versions 2.5.301 and 3.1.7.
Critical Impact
Remote attackers can trigger an AccessViolationException causing process termination, with potential limited memory disclosure from over-read data before failure.
Affected Products
- MessagePack for C# versions prior to 2.5.301
- MessagePack for C# 3.x versions prior to 3.1.7
- Applications using Lz4Block or Lz4BlockArray compression modes
Discovery Timeline
- 2026-06-22 - CVE-2026-48109 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-48109
Vulnerability Analysis
The vulnerability stems from improper input validation [CWE-20] in the LZ4 decompression routine within MessagePack for C#. When applications deserialize payloads using the Lz4Block or Lz4BlockArray compression modes, the decoder invokes a deprecated fast-decompression algorithm. This algorithm does not accept or enforce a source-length bound during decompression operations.
Attackers can craft MessagePack payloads containing manipulated LZ4 token and length fields. These malformed fields cause the decompressor to read past the end of the compressed input buffer. The result is an AccessViolationException that terminates the .NET process, producing a denial of service condition. Under some conditions, the over-read may also expose limited unintended memory contents before the access violation occurs.
Root Cause
The root cause is the use of a fast-path LZ4 decompression implementation that omits source boundary checks. Safe LZ4 decoders validate both the input cursor and output cursor against their respective buffer lengths. The deprecated implementation in MessagePack for C# trusts the length fields encoded within the LZ4 stream, allowing attacker-controlled values to drive out-of-bounds reads.
Attack Vector
Exploitation requires no authentication or user interaction. Any endpoint that accepts MessagePack-serialized data with LZ4 compression enabled becomes an attack surface. The attacker submits a malformed compressed payload, and the deserializer triggers the out-of-bounds read during decompression. Refer to the GitHub Security Advisory GHSA-hv8m-jj95-wg3x for additional technical detail.
Detection Methods for CVE-2026-48109
Indicators of Compromise
- Unexpected AccessViolationException entries in .NET application logs referencing MessagePack deserialization stack frames
- Process crashes correlated with inbound traffic containing MessagePack payloads using LZ4 compression
- Abnormal restart cycles of services that accept serialized MessagePack input over the network
Detection Strategies
- Inventory all .NET projects and dependencies to identify use of MessagePack package versions prior to 2.5.301 or 3.1.7
- Review application code for the MessagePackCompression.Lz4Block and MessagePackCompression.Lz4BlockArray configuration options
- Monitor crash dumps for stack traces involving the LZ4 decoder path in MessagePack assemblies
Monitoring Recommendations
- Forward .NET unhandled exception telemetry to a centralized logging platform for correlation
- Alert on repeated process terminations of services consuming MessagePack data from untrusted sources
- Track inbound payload sizes and decompression failures at API gateways fronting MessagePack endpoints
How to Mitigate CVE-2026-48109
Immediate Actions Required
- Upgrade MessagePack for C# to version 2.5.301 or 3.1.7 or later
- Audit all services and applications that deserialize MessagePack data from untrusted network sources
- Restrict exposure of MessagePack deserialization endpoints to authenticated and trusted clients where feasible
Patch Information
The maintainers fixed the vulnerability in MessagePack for C# versions 2.5.301 and 3.1.7. Update the MessagePack NuGet package reference in affected projects and redeploy. Detailed remediation guidance is available in the MessagePack-CSharp GitHub Security Advisory.
Workarounds
- Disable Lz4Block and Lz4BlockArray compression modes until patched versions are deployed
- Use the default uncompressed MessagePack resolver for endpoints exposed to untrusted input
- Place a strict size limit and schema validation layer in front of services that must accept compressed MessagePack payloads
# Update the MessagePack NuGet package to a fixed version
dotnet add package MessagePack --version 3.1.7
# Or for the 2.x branch
dotnet add package MessagePack --version 2.5.301
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
