CVE-2026-48517: MessagePack-CSharp Type-Filtering Bypass in Typeless Deserialization

Technical summary

MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) performs a shallow type inspection during typeless deserialization. The method validates the declared type name but fails to recursively traverse array element types (e.g., Type[]) or generic type arguments (e.g., List<BlockedType>). An attacker supplying a crafted MessagePack payload can declare a wrapped variant of a blocked type, pass the outer validation layer, and trigger formatter instantiation for the inner dangerous type. The vulnerability affects typeless deserialization scenarios where the library is expected to enforce type restrictions as a security boundary.

Business impact

Applications relying on MessagePack for C# typeless deserialization with enabled type restrictions face gadget chain or arbitrary code execution risks. If an attacker can control the MessagePack input stream, they may achieve remote code execution by triggering instantiation of types capable of executing malicious logic during deserialization. This is particularly severe in service-to-service communication, API gateways, or any trust boundary where MessagePack is used to deserialize untrusted data. Organizations using this library for security-sensitive deserialization must assume their type-blocking controls are ineffective until patching.

Affected systems

MessagePack for C# versions prior to 2.5.301 (v2.x line) and prior to 3.1.7 (v3.x line) are affected. The vulnerability applies only when typeless deserialization is in use; strongly-typed deserialization is not affected. Any application or microservice component using MessagePack-CSharp with typeless deserialization features should be inventoried. This includes .NET Framework, .NET Core, and .NET 5+ environments.

Exploitability

Exploitation requires the attacker to control the MessagePack input stream and to have knowledge of available gadget types in the target application's assembly context. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network accessibility and low attack complexity. No user interaction or authentication is required. The practical difficulty depends on the availability of suitable gadget chains; many .NET libraries and the framework itself expose types capable of arbitrary code execution when deserialized. This is a practical remote vulnerability in many real-world deployments.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the v2.x branch, or to version 3.1.7 or later for the v3.x branch. The patched versions implement recursive type inspection, validating not only the outer type but also array element types and generic type parameters against the disallowed type list. After patching, validate that your application's package dependencies are correctly resolved and test deserialization of trusted payloads in staging before production deployment.

Patch guidance

Consult the official MessagePack-CSharp repository and NuGet package releases for v2.5.301 and v3.1.7. Update your project file or package management configuration to reference the patched version. If you are on a v2.x release, upgrade to 2.5.301; if on v3.x, upgrade to 3.1.7. The fix changes the internal validation logic to traverse nested type structures; no API changes are anticipated for applications using standard deserialization patterns. Verify compatibility in your test environment before rolling out broadly.

Detection guidance

Monitor for MessagePack deserialization exceptions or security audit logs indicating type validation failures (ThrowIfDeserializingTypeIsDisallowed being invoked). Grep your codebase for calls to typeless deserialization methods (e.g., MessagePackSerializer.Deserialize with typeof(object) or non-specific type parameters). Review network traffic or log files for unusual MessagePack messages with array or generic type wrappers where simple types are expected. In-depth detection may require custom instrumentation of MessagePack deserialization callbacks or dynamic type inspection at runtime.

Why prioritize this

HIGH severity due to the combination of network accessibility, low attack complexity, and integrity/code execution impact. The bypass of intended security controls transforms a protective mechanism into a false sense of security, making this a critical issue for any team relying on MessagePack typeless deserialization. The fix is straightforward and low-risk, justifying immediate patching within affected environments.

Risk score, explained

The CVSS 7.5 score reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) and no authentication or user interaction requirements. The impact is integrity and availability (I:H, A:N), corresponding to code execution potential. The vulnerability is not scored as critical (9.0+) because the attack surface is limited to applications explicitly using typeless deserialization; strongly-typed usage is unaffected. Organizations using the typeless features in security-sensitive contexts should treat this as effectively critical for their risk model.

Frequently asked questions