MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

published 2026-06-22 4 mo ago modified 2026-06-25 4 mo ago also GHSA-cj9g-3mj2-g8vv , EUVD-2026-38384

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.

Patch / fix

fixed in 2

nuget MessagePack 2.5.301, 3.1.7
messagepack messagepack 2.5.301, 3.1.7

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-23)

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	MessagePack	<2.5.301 >=3.0, <3.1.7	2.5.301 3.1.7

Affected products

MessagePack-CSharp MessagePack-CSharp

Classification

Weakness

CWE-674 Uncontrolled Recursion

References

github.com /MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-cj9g-3mj2-g8vv
web, mitigation, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-48512
advisory
github.com /MessagePack-CSharp/MessagePack-CSharp
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary