CVE-2026-48513: MessagePack C# Union Deserialization Denial of Service

Technical summary

The DynamicUnionResolver in MessagePack for C# generates runtime deserializers for union types but omits critical security calls to MessagePackSecurity.DepthStep(ref reader) and corresponding depth decrement operations during recursive deserialization paths. This inconsistency means union deserialization does not participate in the maximum object graph depth enforcement mechanism that protects other recursive formatters. Specifically, when encountering unknown union keys, the emitted deserializer invokes reader.Skip() on untrusted input without an enclosing depth management context, enabling stack exhaustion and denial of service attacks. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion).

Business impact

Applications relying on MessagePack for C# to deserialize untrusted data—particularly in REST APIs, message brokers, or distributed systems—face availability risk. An attacker can trigger application crashes or resource exhaustion by sending malicious MessagePack payloads containing deeply nested or specially crafted union types, effectively denying service to legitimate users. The impact is limited to availability; confidentiality and integrity are not affected. Organizations processing MessagePack data from external sources should treat this as a medium-to-high priority operational concern.

Affected systems

All versions of MessagePack for C# prior to 2.5.301 (for the 2.x branch) and prior to 3.1.7 (for the 3.x branch) are affected. Any application using these libraries to deserialize untrusted MessagePack data is potentially vulnerable. The risk is highest in scenarios where user-supplied or internet-sourced data is deserialized without additional input validation.

Exploitability

This vulnerability requires no authentication or user interaction and can be exploited over the network with a single malformed MessagePack payload. The attack surface is broad for any service accepting MessagePack input. However, exploitation requires knowledge of the target's union type definitions and the ability to send data that triggers the unsafe skip path. Public exploit code is unlikely to be immediately available, but the underlying issue is straightforward enough that motivated attackers can craft targeted payloads. The absence of KEV listing does not indicate low risk in practice—rather, it reflects the recent publication date and limited public exploitation so far.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the 2.x series, or to 3.1.7 or later for the 3.x series. These versions restore proper depth-step enforcement in union deserialization. Verify compatibility with your application's .NET framework before deploying; consult the MessagePack release notes for any breaking changes. As a interim mitigation for applications unable to patch immediately, implement external input validation and size limits on MessagePack payloads, though this is not a substitute for a proper patch.

Patch guidance

1. Identify which version of MessagePack for C# your application currently uses (check your .csproj or packages.config). 2. If running 2.x, update to 2.5.301 or later; if running 3.x, update to 3.1.7 or later. 3. Test thoroughly in a non-production environment, particularly any code paths involving union type deserialization. 4. Roll out updates through your standard release process. 5. Verify the patch by reviewing the MessagePack GitHub repository or NuGet package metadata to confirm the version includes the depth-step fixes. No configuration changes are required post-patch.

Detection guidance

Monitor applications for sudden spikes in memory consumption, CPU usage, or process crashes correlated with incoming MessagePack data. Enable detailed logging of deserialization operations if available. In network traffic, look for unusually large or deeply nested MessagePack payloads sent to your application endpoints. Intrusion detection signatures are unlikely to be highly effective since the malicious payload structure depends on your specific union definitions, but anomalous object nesting depths in MessagePack streams warrant investigation. Post-patch, baseline behavior should normalize.

Why prioritize this

Rate this vulnerability HIGH priority (CVSS 7.5). It affects a widely-used serialization library, requires no authentication, and directly impacts availability. However, practical risk depends on whether your organization uses MessagePack for C# and whether you deserialize untrusted data. If MessagePack is not in your tech stack, this can be lower priority. If you do use it for API or message processing, patch within days rather than weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible denial-of-service vector with no complexity barriers (CWE-674, uncontrolled recursion). The score appropriately does not assign impact to confidentiality or integrity, since the flaw only affects availability. The 'high' severity correctly captures the operational risk, though real-world impact will vary based on deployment context and whether depth-limit enforcement would have prevented actual attacks against your infrastructure.

Frequently asked questions