Executive brief
Nerdbank.MessagePack is a library used to process data in the MessagePack format, often used for high-performance communication between services. A vulnerability in how it handles date and time information allows an attacker to send a specially crafted message that crashes the application. This results in a denial-of-service, potentially shutting down APIs, background workers, or other critical business services that process external data.
Technical details
A vulnerability exists in Nerdbank.MessagePack's DateTime decoding logic where the `tokenSize` is derived from an attacker-controlled extension length before validating that the length matches the legal MessagePack timestamp sizes (4, 8, or 12 bytes). If the input buffer is incomplete, this unvalidated size is passed to a streaming reader's slow path and used in a `stackalloc` operation. An attacker can provide a small payload declaring an extremely large extension length, exhausting the stack and triggering a non-catchable `StackOverflowException`. This results in immediate process termination (Denial of Service). The issue is fixed in version 1.1.62.
Affected products
- AArnott Nerdbank.MessagePack < 1.1.62
Timeline
- 2026-04-29: patched: Fix merged in pull request 941
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-14: disclosed: NVD publication date
References
- https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3
- https://github.com/AArnott/Nerdbank.MessagePack/pull/941
- https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30
- https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62
- https://github.com/msgpack/msgpack/blob/master/spec.md