CVE-2026-48513 Overview
CVE-2026-48513 affects MessagePack for C#, a binary serialization library used in .NET applications. The vulnerability stems from runtime-generated union deserializers emitted by DynamicUnionResolver. These deserializers fail to call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths.
This flaw means union deserialization bypasses the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. The issue is classified under [CWE-674] (Uncontrolled Recursion) and is fixed in versions 2.5.301 and 3.1.7.
Critical Impact
Attackers can submit crafted MessagePack payloads that trigger uncontrolled recursion in union deserialization, leading to stack exhaustion and denial of service.
Affected Products
- MessagePack for C# versions prior to 2.5.301
- MessagePack for C# versions prior to 3.1.7 (3.x branch)
- .NET applications using DynamicUnionResolver for union type deserialization
Discovery Timeline
- 2026-06-22 - CVE-2026-48513 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-48513
Vulnerability Analysis
MessagePack for C# uses runtime code generation to build efficient deserializers for union types. The DynamicUnionResolver emits IL code that reads union discriminator keys and dispatches to the appropriate concrete formatter. To protect against malicious deeply nested payloads, the library exposes MessagePackSecurity.DepthStep which increments and validates a depth counter.
The generated union deserializers omit this depth tracking. Recursive deserialization paths and the reader.Skip() fallback for unknown union keys execute without participating in depth enforcement. Other formatters in the library correctly invoke DepthStep, making union types an inconsistent gap in the security model.
Exploitation does not require authentication when an application accepts MessagePack input over the network. The attack complexity is elevated because the target application must use union types with DynamicUnionResolver. Successful exploitation causes process-level resource exhaustion rather than code execution or data disclosure.
Root Cause
The root cause is missing security control instrumentation in IL-emitted code. The hand-written formatters in MessagePack for C# correctly call MessagePackSecurity.DepthStep(ref reader) before recursive descent and decrement reader.Depth afterward. The dynamic IL emitter in DynamicUnionResolver does not generate equivalent instructions, so depth state remains static across recursion frames.
Attack Vector
An attacker delivers a MessagePack payload containing deeply nested union values to any endpoint that deserializes untrusted input. Each level of nesting consumes stack frames without triggering the configured MaximumObjectGraphDepth limit. The reader.Skip() path on unknown union keys further allows attackers to embed nested structures inside discriminator branches the application would otherwise reject.
The vulnerability manifests during deserialization of attacker-controlled bytes. See the GitHub Security Advisory GHSA-wfr3-xj75-pfwh for the full technical writeup and patch diff.
Detection Methods for CVE-2026-48513
Indicators of Compromise
- Repeated process crashes or StackOverflowException events in .NET applications consuming MessagePack input
- Abnormally large or deeply nested MessagePack payloads received at API ingestion points
- Unexplained worker process restarts correlated with MessagePack endpoint traffic
Detection Strategies
- Inventory .NET dependencies and flag any MessagePack package below 2.5.301 or 3.1.7 using software composition analysis tools.
- Inspect code paths that register DynamicUnionResolver or use [Union] attributes on serializable types.
- Add server-side payload size and structural depth checks at the HTTP or message broker layer before deserialization.
Monitoring Recommendations
- Monitor application crash telemetry and unhandled exception logs for stack overflow events in serialization stack frames.
- Track CPU and memory pressure on services that accept MessagePack input from external clients.
- Alert on sudden increases in payload size distribution at ingestion endpoints handling binary serialization.
How to Mitigate CVE-2026-48513
Immediate Actions Required
- Upgrade the MessagePack NuGet package to 2.5.301 for the 2.x branch or 3.1.7 for the 3.x branch.
- Audit application code for use of [Union] attributes and DynamicUnionResolver registration.
- Enforce request size limits on endpoints that accept MessagePack input from untrusted sources.
Patch Information
The MessagePack for C# maintainers released fixed versions 2.5.301 and 3.1.7. The patch adds MessagePackSecurity.DepthStep calls to the IL emitted by DynamicUnionResolver for both recursive deserialization and skip paths. Refer to the GitHub Security Advisory GHSA-wfr3-xj75-pfwh for release notes and commit details.
Workarounds
- Reject or validate MessagePack payloads at the network edge using maximum size thresholds when patching is not immediately possible.
- Avoid exposing endpoints that deserialize MessagePack union types to unauthenticated network clients.
- Replace DynamicUnionResolver with a custom resolver that enforces depth limits if upgrade is blocked.
# Upgrade via .NET CLI
dotnet add package MessagePack --version 3.1.7
# Or for the 2.x branch
dotnet add package MessagePack --version 2.5.301
# Verify installed version
dotnet list package | grep MessagePack
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
