Executive brief
MessagePack-CSharp is a library used to serialize and deserialize data in the MessagePack format. A vulnerability exists where the library fails to limit how deeply it searches through nested data when skipping unknown or ignored fields. An attacker can exploit this by sending a specially crafted, deeply nested message that causes the application to crash, leading to a denial of service.
Technical details
The vulnerability is classified as uncontrolled recursion (CWE-674) within the MessagePackReader.TrySkip() method. This method recursively descends into nested arrays and maps without incrementing the reader depth or validating against MessagePackSecurity.MaximumObjectGraphDepth. Because many formatters call Skip() when encountering unknown keys or ignored fields, an attacker can trigger this path during normal deserialization. In .NET, a StackOverflowException is typically uncatchable, leading to immediate termination of the host process. The issue is fixed in versions 2.5.301 and 3.1.7 by implementing iterative traversal or proper depth accounting.
Affected products
- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed: Advisory published by maintainer
- 2026-06-22: advisory: NVD published date
- 2026-06-25: patched: GitHub Advisory reviewed and updated