CVE-2026-44375: AArnott Nerdbank.MessagePack stack overflow in DateTime decoding

CVE-2026-44375 · Severity: high · CVSS 7.5 · Published 2026-05-14

Nerdbank.MessagePack is a library used to process data in the MessagePack format, often used for high-performance communication between services. A vulnerability in how it handles date and time information allows an attacker to send a specially crafted message that crashes the application. This results in a denial-of-service, potentially shutting down APIs, background workers, or other critical business services that process external data.

Technologies: Andrew Arnott Nerdbank.MessagePack. Vendors: Andrew Arnott, NuGet.

Quick answers

Is CVE-2026-44375 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44375 being exploited in the wild.
How severe is CVE-2026-44375?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
Andrew Arnott Nerdbank.MessagePack < 1.1.62; Nerdbank.MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=1.1.62.
Is there a fix for CVE-2026-44375?
Yes. Nerdbank.MessagePack (NuGet): upgrade to 1.1.62 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44375 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44375?
Check whether you run Andrew Arnott Nerdbank.MessagePack or Nerdbank.MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Nerdbank.MessagePack (NuGet): upgrade to 1.1.62 or later
    dotnet add package Nerdbank.MessagePack --version 1.1.62

Technical details

A vulnerability exists in Nerdbank.MessagePack's DateTime decoding logic where the `tokenSize` is derived from an attacker-controlled extension length before validating that the length matches the legal MessagePack timestamp sizes (4, 8, or 12 bytes). If the input buffer is incomplete, this unvalidated size is passed to a streaming reader's slow path and used in a `stackalloc` operation. An attacker can provide a small payload declaring an extremely large extension length, exhausting the stack and triggering a non-catchable `StackOverflowException`. This results in immediate process termination (Denial of Service). The issue is fixed in version 1.1.62.

Affected products

  • AArnott Nerdbank.MessagePack < 1.1.62

Identifiers

  • CVE-2026-44375
  • GHSA-2cwq-pwfr-wcw3

Timeline

  • 2026-04-29: patched: Fix merged in pull request 941
  • 2026-05-06: advisory: GitHub Advisory published
  • 2026-05-14: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.