CVE-2026-48514: MessagePack for C# Unvalidated Memory Allocation DoS

Technical summary

The vulnerability exists in UnsafeBlitFormatterBase<T>.Deserialize, which deserializes MessagePack extension payloads. The flaw occurs because the method reads a byteLength value directly from the extension payload and uses it to allocate a T[] array before validating this length against the outer extension header bounds or remaining input bytes. While the extension header itself is bounded by available input, that constraint is not applied to the inner byteLength field prior to memory allocation. This results in an unbounded allocation primitive: a 10-byte extension header can claim to contain a multi-gigabyte array, and the library will attempt to allocate that memory before discovering the data is missing. This is classified as an unvalidated resource allocation (CWE-770).

Business impact

Applications using MessagePack for C# to deserialize untrusted data face denial-of-service risk. A remote attacker can cause memory exhaustion and service unavailability by sending specially crafted MessagePack messages. This is particularly dangerous in high-throughput scenarios (APIs, message queues, microservices) where an attacker can trigger the condition repeatedly. The lack of authentication required amplifies the risk; no credentials or interaction are necessary to exploit this.

Affected systems

MessagePack for C# versions prior to 2.5.301 and 3.x versions prior to 3.1.7 are affected. Both the 2.5.x and 3.x release lines contain the vulnerability. Organizations should check their dependency trees for MessagePack references and verify which versions are in use, as the library is commonly used in .NET applications for serialization in APIs, caching layers, and distributed systems.

Exploitability

Exploitability is straightforward: the vulnerability requires no authentication, no user interaction, and minimal network resources. An attacker only needs network access to the application and the ability to send MessagePack-formatted data. The attack vector is network-based and no special conditions (low complexity) are required. The attacker constructs a malicious extension payload with an undersized outer header but an enormous claimed inner length, then sends it to any endpoint that deserializes MessagePack. Modern exploit tooling makes this trivial to automate. However, the vulnerability is not yet tracked in public exploit databases and no active in-the-wild exploitation has been documented.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the 2.5.x branch, or to version 3.1.7 or later for the 3.x branch. These versions implement proper validation of byteLength against the extension header bounds before allocation, closing the uncontrolled allocation window. Verify patching in all dependencies, including transitive ones, using your package manager's dependency tree tools.

Patch guidance

For .NET projects using NuGet: update the MessagePack package via the Package Manager Console with 'Update-Package MessagePack' or use the NuGet Package Manager UI to upgrade to 2.5.301+ or 3.1.7+. For applications using .NET CLI, run 'dotnet add package MessagePack --version 2.5.301' (or the appropriate 3.x version). Test in a development environment before deploying to production. If you use MessagePack indirectly through another NuGet package, check that dependency's release notes to confirm it has been updated to use a patched MessagePack version. The fix validates byteLength against the extension header length, eliminating the allocation-before-validation window.

Detection guidance

Monitor application memory usage for sudden spikes when processing MessagePack data from untrusted sources. Set memory alerts on processes that deserialize external data. On the network level, look for unusual MessagePack extension payloads with very small headers followed by large allocation attempts—though this is difficult to detect without deep inspection. Application logging: enable verbose logging in MessagePack deserialization and correlate memory spikes with specific data sources. Intrusion detection systems may eventually detect characteristic patterns of this attack (small payloads causing large allocations), but behavior-based detection (anomalous memory growth) is more practical in the near term. Prioritize production systems that accept MessagePack from untrusted external sources.

Why prioritize this

This is a high-severity denial-of-service vulnerability affecting a widely-used .NET serialization library. The attack requires no authentication or interaction, is trivial to exploit, and can crash critical services with minimal attacker resources. While not yet actively exploited, the simplicity of the attack and the ubiquity of MessagePack in microservices architectures make this a near-term risk. Organizations should prioritize patching within their standard update cycle, with higher urgency for public-facing APIs and services handling untrusted MessagePack data.

Risk score, explained

CVSS 7.5 (HIGH) reflects a network-accessible denial-of-service condition affecting availability with no authentication required, no user interaction, and low attack complexity. The score correctly penalizes the lack of confidentiality and integrity impact (the attack only causes resource exhaustion, not data breach or corruption), but appropriately weights the universal availability impact. In a defense-in-depth context, organizations running MessagePack-dependent services on resource-constrained infrastructure or in multi-tenant environments should treat this as a higher priority than the CVSS alone suggests.

Frequently asked questions