CVE-2026-48506: Messagepack for C# DoS Vulnerability

CVE-2026-48506 Overview

CVE-2026-48506 affects MessagePack for C#, a widely used MessagePack serializer for the .NET ecosystem. The vulnerability resides in MessagePackReader.TrySkip(), which recursively descends into nested arrays and maps without incrementing reader depth. This behavior bypasses MessagePackSecurity.MaximumObjectGraphDepth, the documented protection against deeply nested object graphs. An attacker who controls serialized input can trigger unbounded recursion and an uncatchable StackOverflowException, terminating the host process. The flaw is tracked under [CWE-674: Uncontrolled Recursion]. Versions prior to 2.5.301 and 3.1.7 are affected.

Critical Impact
Remote attackers can crash any .NET process deserializing untrusted MessagePack data by sending a deeply nested payload, producing a denial-of-service condition that cannot be recovered through normal exception handling.

Affected Products

MessagePack-CSharp versions prior to 2.5.301
MessagePack-CSharp versions 3.0.0 through versions prior to 3.1.7
Applications using generated or dynamic formatters that invoke reader.Skip() on untrusted input

Discovery Timeline

2026-06-22 - CVE-2026-48506 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48506

Vulnerability Analysis

MessagePack for C# provides MessagePackSecurity.MaximumObjectGraphDepth as the documented mechanism to limit recursion when deserializing untrusted payloads. The MessagePackReader.TrySkip() method, however, does not honor this control. When TrySkip() encounters a nested array or map, it recursively descends into each element without incrementing the depth counter or invoking the configured depth check.

Generated formatters call reader.Skip() in several common scenarios: unknown map keys, unknown array members, fields marked as ignored, and data skipped for forward compatibility. Any deeply nested value positioned where the formatter chooses to skip it traverses the vulnerable recursive path. The result is unbounded stack growth ending in a StackOverflowException, which the .NET runtime treats as a non-recoverable failure that terminates the process.

Root Cause

The root cause is a missing depth check in the skip path. TrySkip() was implemented to advance the reader past a value without materializing it, but the implementation relies on the call stack to traverse nested structures. Because MaximumObjectGraphDepth is enforced only on the deserialization path that builds objects, the skip path silently bypasses the limit. This is a classic [CWE-674] uncontrolled recursion pattern.

Attack Vector

The vulnerability is exploitable over the network wherever an application deserializes attacker-supplied MessagePack data. The attacker crafts a payload containing a single deeply nested array or map placed in a position the target formatter will skip. Common candidates include unknown fields, fields marked [IgnoreMember], or trailing schema-evolution data. No authentication or user interaction is required. The vulnerability affects availability only; confidentiality and integrity are not impacted.

No public exploit code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical details refer to the GitHub Security Advisory GHSA-vh6j-jc39-fggf.

Detection Methods for CVE-2026-48506

Indicators of Compromise

Process termination of .NET services with exit codes consistent with unhandled StackOverflowException
Crash dumps showing recursive frames within MessagePack.MessagePackReader.TrySkip or its internal helpers
Sudden service restarts correlated with inbound MessagePack traffic from a single source
Application logs ending abruptly mid-deserialization without a logged exception

Detection Strategies

Inventory dependencies for MessagePack NuGet package versions below 2.5.301 or below 3.1.7 using SBOM tooling or dotnet list package --vulnerable
Inspect crash telemetry and Windows Error Reporting (WER) data for StackOverflowException originating in MessagePack assemblies
Add input-size and nesting-depth instrumentation at API boundaries that accept MessagePack payloads

Monitoring Recommendations

Alert on unexpected restarts of services that deserialize MessagePack over RPC, SignalR, or message queues
Monitor for inbound payloads exceeding expected size or containing unusually high counts of map and array opening bytes
Correlate process crashes with upstream network sources to identify probing behavior

How to Mitigate CVE-2026-48506

Immediate Actions Required

Upgrade the MessagePack NuGet package to 2.5.301 or 3.1.7 or later across all affected applications and services
Rebuild and redeploy any application that statically links or AOT-compiles generated MessagePack formatters
Audit all entry points that accept MessagePack data from untrusted sources and treat them as exposed until patched

Patch Information

The maintainers released fixed builds in versions 2.5.301 and 3.1.7. Both releases correct MessagePackReader.TrySkip() so that nested arrays and maps increment the reader depth and respect MessagePackSecurity.MaximumObjectGraphDepth. Patch details are published in the GitHub Security Advisory GHSA-vh6j-jc39-fggf.

Workarounds

Restrict MessagePack deserialization to authenticated and trusted callers until the patched version is deployed
Place a size-bounded reverse proxy or message broker in front of services to drop oversized payloads
Validate or transcode incoming MessagePack data through a hardened parser that enforces nesting limits before it reaches the vulnerable library

bash

# Configuration example
dotnet add package MessagePack --version 3.1.7
dotnet list package --vulnerable --include-transitive