CVE-2026-48512: MessagePack-CSharp JSON Recursion Denial-of-Service

Technical summary

MessagePack-CSharp versions prior to 2.5.301 and 3.1.7 contain insufficient recursion depth controls across three distinct code paths: (1) ConvertFromJson does not consult MessagePackSecurity.MaximumObjectGraphDepth when recursively processing nested JSON arrays and objects in FromJsonCore(); (2) TinyJsonReader.ReadNextToken() recursively consumes comma and colon separators without limit, allowing even malformed JSON to exhaust the stack; and (3) ConvertToJson's typeless extension handling for ext-100 recurses into ToJsonCore() without applying MessagePackSecurity.DepthStep(). Each path bypasses the library's established depth-limiting mechanisms, enabling attacker-controlled JSON to cause an uncatchable StackOverflowException.

Business impact

Applications relying on MessagePack-CSharp for JSON conversion are exposed to remote denial-of-service attacks. An attacker can craft malicious JSON payloads to crash processes handling untrusted input, disrupting service availability. Organizations using this library in message processing pipelines, API gateways, or any JSON-to-MessagePack conversion flow should prioritize assessment and patching to prevent operational disruption.

Affected systems

MessagePack for C# versions prior to 2.5.301 (v2 branch) and 3.1.7 (v3 branch) are vulnerable. Systems using these libraries to deserialize JSON or convert between JSON and MessagePack formats are at risk. The vulnerability is triggered only when the JSON conversion helpers (ConvertFromJson, ConvertToJson) are called; standard typed MessagePack deserialization is unaffected.

Exploitability

Exploitation requires only network access to send malicious JSON to an application using the vulnerable conversion functions; no authentication, user interaction, or complex conditions are necessary. Attackers can craft deeply nested JSON objects or arrays, or malformed JSON with long separator sequences, to trigger the stack exhaustion. The attack surface is high for any exposed endpoint accepting JSON input processed through MessagePack-CSharp's conversion methods.

Remediation

Upgrade MessagePack-CSharp to version 2.5.301 or later for the v2 branch, or 3.1.7 or later for the v3 branch. Verify your project's dependency version and check release notes to confirm the patch addresses your specific branch. If immediate patching is not feasible, implement input validation to reject deeply nested JSON structures or apply network-level rate limiting and resource quotas to mitigate stack exhaustion attacks.

Patch guidance

Consult the MessagePack-CSharp project repository and release notes to confirm the exact patched versions for your branch (2.5.301 for v2, 3.1.7 for v3). Update through your package manager (e.g., NuGet for .NET projects) and test thoroughly in a non-production environment before deploying. Verify that your application's JSON conversion code paths exercise the fixed recursion checks.

Detection guidance

Monitor for unexpected StackOverflowException errors in application logs, particularly in code paths calling ConvertFromJson or ConvertToJson. Implement runtime guards to catch and log stack exhaustion attempts; consider adding application-level depth limits on JSON parsing. During network traffic analysis, flag unusually deep JSON structures or suspicious separator patterns in otherwise malformed JSON directed at MessagePack endpoints.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (7.5), lack of authentication requirements, and ease of exploitation. Any exposed endpoint processing untrusted JSON through MessagePack-CSharp conversion functions is immediately at risk of denial-of-service. The impact is direct availability loss without requiring complex exploitation chains.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible vulnerability (AV:N) with no privilege or interaction requirements (AC:L, PR:N, UI:N), affecting availability (A:H) but not confidentiality or integrity. The high severity reflects the ease of triggering denial-of-service in any system relying on JSON-to-MessagePack conversion without depth enforcement.

Frequently asked questions