CVE-2026-48512 Overview
CVE-2026-48512 affects MessagePack for C#, a widely used MessagePack serializer for the .NET ecosystem. The vulnerability resides in JSON conversion helpers rather than typed MessagePack deserialization. Multiple recursion paths fail to consistently enforce the configured depth limit, allowing attacker-controlled input to exhaust the process stack.
The issue is tracked as [CWE-674: Uncontrolled Recursion]. Affected paths include MessagePackSerializer.ConvertFromJson, TinyJsonReader.ReadNextToken(), and the typeless extension branch (ext-100) in MessagePackSerializer.ConvertToJson. Fixed versions are 2.5.301 and 3.1.7.
Critical Impact
Remote attackers can submit crafted JSON to trigger an uncatchable StackOverflowException, terminating the host process and causing denial of service.
Affected Products
- MessagePack-CSharp versions prior to 2.5.301
- MessagePack-CSharp 3.x versions prior to 3.1.7
- .NET applications consuming MessagePackSerializer.ConvertFromJson or ConvertToJson on untrusted input
Discovery Timeline
- 2026-06-22 - CVE-2026-48512 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-48512
Vulnerability Analysis
The vulnerability stems from three distinct recursion paths in the JSON conversion component of MessagePack for C#. None of these paths consistently consult MessagePackSecurity.MaximumObjectGraphDepth, the configuration value intended to bound recursion depth.
MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without invoking the configured depth check. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, so even malformed JSON consisting of long separator runs consumes one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 calls ToJsonCore() recursively without applying MessagePackSecurity.DepthStep(ref reader).
A successful trigger produces a StackOverflowException. In .NET, this exception is not catchable by user code and terminates the process immediately, defeating any application-level exception handling.
Root Cause
The root cause is inconsistent enforcement of the security depth boundary across recursive code paths. The library exposes MaximumObjectGraphDepth and DepthStep as the intended controls, but the JSON conversion helpers and the ext-100 typeless branch bypass them. This is a classic [CWE-674] uncontrolled recursion pattern.
Attack Vector
An attacker submits crafted JSON or MessagePack ext-100 payloads to any network-exposed endpoint that calls ConvertFromJson or ConvertToJson. Deeply nested arrays, deeply nested objects, or long runs of separator characters such as commas and colons are sufficient. Authentication is not required when the parsing endpoint is publicly reachable. The result is process termination, which translates to denial of service for any application or service consuming the affected APIs.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-cj9g-3mj2-g8vv for technical details.
Detection Methods for CVE-2026-48512
Indicators of Compromise
- Unexpected process termination of .NET services with no managed exception logged, consistent with an uncatchable StackOverflowException.
- Application or container restarts immediately after receiving JSON payloads on endpoints backed by MessagePack for C#.
- Inbound HTTP requests containing JSON with extreme nesting depth or unusually long runs of , and : characters.
Detection Strategies
- Inventory .NET applications and identify dependencies on MessagePack package versions below 2.5.301 or 3.x below 3.1.7 using SBOM tooling or dotnet list package --vulnerable.
- Inspect source for calls to MessagePackSerializer.ConvertFromJson and ConvertToJson that operate on untrusted input.
- Deploy WAF rules to flag JSON requests exceeding a reasonable nesting depth or containing abnormal separator runs.
Monitoring Recommendations
- Alert on abrupt process exits without managed exception stack traces in .NET application logs and container orchestration events.
- Track request size distributions and depth metrics on endpoints performing MessagePack JSON conversion.
- Monitor crash dumps for stack frames in FromJsonCore, TinyJsonReader.ReadNextToken, or ToJsonCore involving the ext-100 branch.
How to Mitigate CVE-2026-48512
Immediate Actions Required
- Upgrade MessagePack NuGet package to 2.5.301 or 3.1.7 or later across all .NET services and rebuild dependent applications.
- Audit application code for use of ConvertFromJson and ConvertToJson against untrusted input and gate calls behind input size and depth validation.
- Restrict or authenticate endpoints that accept JSON or MessagePack payloads from untrusted sources until patches are deployed.
Patch Information
The maintainers fixed CVE-2026-48512 in MessagePack-CSharp versions 2.5.301 and 3.1.7. The fixes add consistent DepthStep enforcement to the affected recursive paths. Refer to the GitHub Security Advisory GHSA-cj9g-3mj2-g8vv for the full patch notes.
Workarounds
- Reject JSON payloads exceeding a strict maximum byte length and nesting depth at the API gateway or WAF before they reach MessagePack parsing.
- Avoid invoking ConvertFromJson or ConvertToJson on attacker-controlled input; prefer typed MessagePack deserialization where the standard MaximumObjectGraphDepth is enforced.
- Run affected services with process supervisors that restart on crash to reduce service downtime until patching completes.
# Upgrade the MessagePack package to a patched release
dotnet add package MessagePack --version 3.1.7
# Or for the 2.x branch
dotnet add package MessagePack --version 2.5.301
# Verify no vulnerable versions remain
dotnet list package --vulnerable --include-transitive
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
