Executive brief
A vulnerability in the MessagePack-CSharp library, which is used to efficiently exchange data between applications, can allow an attacker to crash a server. By sending a specially crafted message containing a date or time field, an attacker can force the application to exhaust its memory, leading to an immediate shutdown. This results in a denial-of-service, disrupting operations and potentially affecting business availability.
Technical details
A stack overflow vulnerability exists in MessagePack-CSharp's MessagePackReader.ReadDateTime() method. The root cause is the use of 'stackalloc' with an attacker-controlled length from the MessagePack extension header before the length is validated against valid timestamp sizes. An attacker can provide a small payload that declares a large extension body, forcing a large single-frame stack allocation that triggers an uncatchable StackOverflowException. This bypasses standard security mitigations like MaximumObjectGraphDepth because it does not rely on recursion. The issue is fixed in version 3.1.7 by validating extension lengths before allocation.
Affected products
- MessagePack-CSharp MessagePack >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed: Advisory published by AArnott
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: advisory: GitHub Advisory Database publication date