CVE-2026-48502: MessagePack for C# stack overflow in MessagePackReader.ReadDateTime

CVE-2026-48502 · Severity: high · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library, which is used to efficiently exchange data between applications, can allow an attacker to crash a server. By sending a specially crafted message containing a date or time field, an attacker can force the application to exhaust its memory, leading to an immediate shutdown. This results in a denial-of-service, disrupting operations and potentially affecting business availability.

Technologies: MessagePack-CSharp MessagePack for C#, MessagePack (NuGet). Vendors: MessagePack-CSharp, NuGet.

Quick answers

Is CVE-2026-48502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48502 being exploited in the wild.
How severe is CVE-2026-48502?
High severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
MessagePack-CSharp MessagePack for C# < 2.5.301, [3.0, 3.1.7); MessagePack (NuGet) >= 3.0, < 3.1.7, ECOSYSTEM:introduced=3.0,fixed=3.1.7.
Is there a fix for CVE-2026-48502?
Yes. MessagePack (NuGet): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48502 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48502?
Check whether you run MessagePack-CSharp MessagePack for C# or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • MessagePack (NuGet): upgrade to 3.1.7 or later
    dotnet add package MessagePack --version 3.1.7

Technical details

A stack overflow vulnerability exists in MessagePack-CSharp's MessagePackReader.ReadDateTime() method. The root cause is the use of 'stackalloc' with an attacker-controlled length from the MessagePack extension header before the length is validated against valid timestamp sizes. An attacker can provide a small payload that declares a large extension body, forcing a large single-frame stack allocation that triggers an uncatchable StackOverflowException. This bypasses standard security mitigations like MaximumObjectGraphDepth because it does not rely on recursion. The issue is fixed in version 3.1.7 by validating extension lengths before allocation.

Affected products

  • MessagePack-CSharp MessagePack >= 3.0, < 3.1.7

Identifiers

  • CVE-2026-48502
  • GHSA-382j-8mxh-c7x2

Timeline

  • 2026-06-09: disclosed: Advisory published by AArnott
  • 2026-06-22: advisory: NVD publication date
  • 2026-06-25: advisory: GitHub Advisory Database publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.