CVE-2026-48506: MessagePack for C# Recursive Bypass Denial of Service

Technical summary

The vulnerability exists in MessagePackReader.TrySkip(), which recursively descends into nested arrays and maps during serialization without incrementing the reader's internal depth counter or invoking the configured depth validation checks that normally prevent unbounded nesting (MessagePackSecurity.MaximumObjectGraphDepth). Generated and dynamic formatters call reader.Skip() when handling unknown map keys, unknown array elements, ignored fields, or forward-compatibility scenarios. Because these skip operations bypass depth validation, a malicious payload containing deeply nested structures in skipped positions can cause unbounded recursion that ultimately raises an uncatchable StackOverflowException. The flaw is rooted in incomplete implementation of recursive depth tracking across all code paths that traverse object graphs.

Business impact

Applications relying on MessagePack for C# to deserialize untrusted network data are vulnerable to remote denial of service. An unauthenticated attacker can crash a service by sending a single malicious payload, leading to unavailability, disrupted business operations, and potential cascading failures in microservice architectures that depend on reliable serialization. The fix is straightforward and low-risk, making rapid patching the clear priority. Organizations processing MessagePack data from external sources face elevated risk until patched.

Affected systems

MessagePack for C# versions prior to 2.5.301 (2.x branch) and prior to 3.1.7 (3.x branch) are affected. Any .NET Framework, .NET Core, or .NET 5+ application that deserializes untrusted MessagePack data using these versions is in scope. The vulnerability is especially critical in services that accept MessagePack input from the network (APIs, message queues, IoT endpoints) without strict upstream validation.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special configuration—only a network path to send a malicious MessagePack payload to the vulnerable service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects this ease of exploitation. Constructing a deeply nested payload is trivial for an attacker with basic knowledge of the MessagePack format. No privileged access, special tooling, or complex social engineering is needed.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later (if on the 2.x branch) or version 3.1.7 or later (if on the 3.x branch). Both versions restore proper depth tracking in TrySkip() and re-enable the MaximumObjectGraphDepth protection. Verify the patch is deployed across all services consuming MessagePack data. No configuration changes or application code modifications are required; the fix is transparent and backward-compatible.

Patch guidance

1. Identify all projects in your environment referencing the MessagePack NuGet package. 2. Update to version 2.5.301+ (2.x line) or 3.1.7+ (3.x line) via NuGet Package Manager or package update tooling. 3. Rebuild and test affected applications to confirm compatibility—these are patch releases with no breaking changes. 4. Deploy updates to all production, staging, and development environments that process MessagePack data. 5. Verify the installed version post-deployment using dotnet list package or NuGet auditing tools. 6. Consider implementing input size and nesting-depth validation at the network boundary as an additional defense layer while patching is in progress.

Detection guidance

Monitor application logs and performance metrics for unexpected StackOverflowException errors correlated with MessagePack deserialization, especially from untrusted network sources. Application performance monitoring (APM) tools can flag sudden increases in exception rates or process crashes. Network-based detection is challenging since MessagePack is binary, but anomalously large payloads with repetitive nested structures may warrant scrutiny. Post-patch, a StackOverflowException during deserialization should be treated as a potential attack indicator and logged for forensic review.

Why prioritize this

This vulnerability warrants immediate attention due to its high CVSS score (7.5), unauthenticated remote exploitability, and simplicity of attack. The fix is low-risk and requires minimal testing. Any service accepting MessagePack from external sources should be patched within days, not weeks. Organizations with defense-in-depth input validation may reduce urgency slightly, but patching remains critical given the trivial nature of crafting a malicious payload.

Risk score, explained

The CVSS 7.5 HIGH rating reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and high availability impact (A:H). The confidentiality and integrity are unaffected (C:N, I:N), but the denial-of-service impact is severe. For any organization receiving untrusted MessagePack data, this is a critical patch; for those with strict firewall controls or input validation, it remains high-priority but may be scheduled slightly further out.

Frequently asked questions