CVE-2026-48502: MessagePack for C# Stack Overflow in Timestamp Parsing

Technical summary

The vulnerability exists in MessagePackReader.ReadDateTime() during the timestamp extension parsing slow path. The library calculates a tokenSize variable that includes the extension body length from the wire data, then immediately uses this value in a stackalloc() operation to reserve stack memory. Critically, the extension length validation—which confirms the size is one of the allowed timestamp formats—occurs *after* the stack allocation, not before. An attacker can craft a MessagePack message with a minuscule payload that claims an enormous timestamp extension body length. This causes stackalloc to request excessive stack space, resulting in a StackOverflowException that bypasses normal exception handling and terminates the process. The vulnerability spans multiple CWE categories: improper buffer sizing (CWE-789), integer overflow in size calculations (CWE-190), unchecked external input (CWE-125), and unsafe deserialization (CWE-502).

Business impact

Any application or service using MessagePack for C# before the patched versions is susceptible to denial-of-service attacks. An attacker can send a single malicious serialized message over the network to crash the host process entirely. This impacts availability directly—there is no data theft or integrity violation, but service continuity is broken. The impact is particularly severe for message-processing backends, API gateways, microservices, and real-time communication systems that deserialize untrusted MessagePack data. Recovery requires process restart; the crash is immediate and unrecoverable at the application level.

Affected systems

MessagePack for C# versions prior to 2.5.301 (for the 2.x branch) and prior to 3.1.7 (for the 3.x branch) are affected. Any application referencing these versions of the NuGet package and consuming MessagePack data—especially from untrusted or external sources—is vulnerable. This includes web services, gRPC implementations, and distributed systems built on .NET Framework or .NET Core that rely on MessagePack for serialization.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special network privileges—only the ability to send a crafted MessagePack message to an application using a vulnerable version. The attack surface is the network boundary where the application deserializes data. Exploitation is trivial from a technical standpoint: constructing a malicious payload with inflated extension length claims is straightforward. However, the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been publicly documented at scale.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the 2.x series, or 3.1.7 or later for the 3.x series. Both versions contain the fix that validates the extension length *before* the stackalloc operation, preventing the malicious allocation. Organizations should identify all internal and third-party applications consuming this NuGet package and prioritize updates. For environments where immediate patching is not feasible, network controls should restrict untrusted MessagePack traffic until patches can be deployed.

Patch guidance

Update your NuGet package reference for MessagePack to the fixed versions: 2.5.301+ or 3.1.7+. Verify the update in your packages.config or .csproj file, rebuild, and redeploy. If your project pins an older major version (e.g., only accepts 2.x releases), ensure the 2.x branch is updated to at least 2.5.301. Test deserialization of MessagePack data in your environments post-patching to confirm normal operation. For third-party libraries that depend on MessagePack, check their release notes for updates that pull in the patched versions.

Detection guidance

Monitor for patterns of incoming MessagePack data with extension type markers claiming very large body lengths relative to payload size—a classic indicator of this attack. Application crash dumps or event logs showing StackOverflowException originating from MessagePackReader.ReadDateTime() are definitive signals. Network-based detection is challenging because the payload is small; focus on behavioral indicators: sudden, unexplained process terminations in services known to deserialize MessagePack, especially if correlated with unusual network traffic spikes to those services. Code review and dependency scanning tools can identify use of vulnerable MessagePack versions in your codebase.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS 3.1 score of 7.5, trivial exploitability, and complete denial-of-service impact. The attack requires no special privileges or user interaction, the fix is straightforward (a version upgrade), and the window for exploitation is wide as long as vulnerable versions remain deployed. Organizations should prioritize this above other medium-severity issues and address it within weeks rather than months.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack vector (AV:N) with low attack complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and high availability impact (A:H). There is no confidentiality or integrity impact (C:N/I:N), which prevents a critical rating. The score appropriately captures the severity: this is a robust remote denial-of-service condition, but not an information disclosure or system compromise. The lack of CISS KEV listing does not diminish the urgency; it reflects the maturity of public exploitation rather than the intrinsic risk.

Frequently asked questions