CVE-2026-48515: MessagePack for C# DOS Vulnerability

CVE-2026-48515 Overview

CVE-2026-48515 affects MessagePack for C#, a widely used MessagePack serializer for the .NET ecosystem. The vulnerability resides in the multi-dimensional array formatters, which read dimension lengths directly from the untrusted payload. The deserializer allocates T[,], T[,,], or T[,,,] arrays before validating that the dimension product matches the encoded element count. An attacker can craft a small payload that declares large dimensions with a tiny inner element array, triggering a large heap allocation. The flaw is tracked under CWE-770: Allocation of Resources Without Limits or Throttling and is fixed in versions 2.5.301 and 3.1.7.

Critical Impact
A remote attacker can submit a small MessagePack payload that forces the deserializer to allocate large multi-dimensional arrays, leading to memory exhaustion and denial of service.

Affected Products

MessagePack-CSharp prior to 2.5.301
MessagePack-CSharp 3.x prior to 3.1.7
.NET applications consuming MessagePack input from untrusted sources

Discovery Timeline

2026-06-22 - CVE-2026-48515 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48515

Vulnerability Analysis

The vulnerability stems from the order of operations in MessagePack-CSharp's multi-dimensional array formatters. The deserializer reads dimension lengths from the payload, then allocates the destination array of type T[,], T[,,], or T[,,,]. Element count validation occurs only after the allocation completes. This allows the declared dimensions to diverge from the actual encoded element count.

The formatter does guard the inner element array header against oversized counts. However, the multi-dimensional allocation bypasses this protection because dimensions are processed independently. An attacker who supplies dimension values whose product is large, paired with an empty or tiny inner array, forces the runtime to commit a large contiguous heap region before any sanity check fires.

Applications that deserialize MessagePack data from network clients, message queues, or file uploads are exposed. Repeated requests can exhaust process memory and cause the host service to terminate with an OutOfMemoryException.

Root Cause

The root cause is missing input validation before resource allocation. The formatter should reconcile the product of all declared dimensions against the encoded element count prior to invoking the array constructor. Because this check is deferred, the runtime honors attacker-supplied dimensions verbatim.

Attack Vector

Exploitation requires sending a crafted MessagePack-encoded multi-dimensional array to any endpoint that deserializes untrusted input using the vulnerable formatters. No authentication is required when the deserialization endpoint is publicly reachable. The vulnerability manifests in the multi-dimensional array formatter logic; refer to the GitHub Security Advisory GHSA-cxmj-83gh-fp49 for the canonical technical description.

Detection Methods for CVE-2026-48515

Indicators of Compromise

Repeated OutOfMemoryException or System.OutOfMemoryException entries in application logs tied to MessagePack deserialization stack frames
Spikes in process working set or managed heap size correlated with inbound MessagePack traffic
Inbound payloads whose decoded multi-dimensional array headers declare dimension products far exceeding payload size

Detection Strategies

Inventory all .NET applications and identify those referencing the MessagePack NuGet package at versions below 2.5.301 or 3.1.7
Inspect deserialization code paths for use of multi-dimensional array types deserialized from untrusted sources
Add runtime telemetry on managed heap growth around MessagePack entry points to flag anomalous allocations

Monitoring Recommendations

Alert on sudden Gen2 garbage collection pressure or large object heap growth in services accepting MessagePack input
Monitor process restarts and crash dumps for stack traces containing MessagePack formatter frames
Capture and review payload size distributions versus post-deserialization object size to detect amplification

How to Mitigate CVE-2026-48515

Immediate Actions Required

Upgrade MessagePack-CSharp to 2.5.301 (2.x branch) or 3.1.7 (3.x branch) without delay
Audit application dependencies, including transitive references, for vulnerable MessagePack versions
Restrict MessagePack deserialization endpoints to authenticated clients where feasible

Patch Information

Maintainers fixed the issue in MessagePack-CSharp 2.5.301 and 3.1.7. The patched formatters validate the product of declared dimensions against the encoded element count before allocating the destination array. Release details and patch references are available in the MessagePack-CSharp Security Advisory.

Workarounds

Enforce strict payload size limits at the ingress layer to bound the impact of any single request
Avoid deserializing multi-dimensional arrays from untrusted sources by switching to flat array contracts
Apply per-client rate limits and circuit breakers on endpoints that consume MessagePack input until patching is complete

bash

# Update the MessagePack NuGet package to a patched release
dotnet add package MessagePack --version 3.1.7
# Or for the 2.x branch
dotnet add package MessagePack --version 2.5.301