# CVE-2026-48506: MessagePack for C# uncontrolled recursion in MessagePackReader.TrySkip

Source: https://junglewise.ai/threats/cve-2026-48506-messagepack-for-c-uncontrolled-recursion-in-messagepackreader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48506 · Severity: high · CVSS 7.5 · Published 2026-06-22

MessagePack-CSharp is a library used to serialize and deserialize data in the MessagePack format. A vulnerability exists where the library fails to limit how deeply it searches through nested data when skipping unknown or ignored fields. An attacker can exploit this by sending a specially crafted, deeply nested message that causes the application to crash, leading to a denial of service.

Technologies: [MessagePack-CSharp MessagePack for C#](https://junglewise.ai/threats/technologies/messagepack-for-c), [MessagePack-CSharp](https://junglewise.ai/threats/technologies/messagepack-csharp), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48506 being exploited in the wild.

**How severe is CVE-2026-48506?** High severity, with a CVSS score of 7.5, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.

**Is there a fix for CVE-2026-48506?** Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48506 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48506?** Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 2.5.301 or later

  ```sh
  dotnet add package MessagePack --version 2.5.301
  ```


## Technical details

The vulnerability is classified as uncontrolled recursion (CWE-674) within the MessagePackReader.TrySkip() method. This method recursively descends into nested arrays and maps without incrementing the reader depth or validating against MessagePackSecurity.MaximumObjectGraphDepth. Because many formatters call Skip() when encountering unknown keys or ignored fields, an attacker can trigger this path during normal deserialization. In .NET, a StackOverflowException is typically uncatchable, leading to immediate termination of the host process. The issue is fixed in versions 2.5.301 and 3.1.7 by implementing iterative traversal or proper depth accounting.

## Affected products

- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48506
- GHSA-vh6j-jc39-fggf

## Timeline

- 2026-06-09: disclosed: Advisory published by maintainer
- 2026-06-22: advisory: NVD published date
- 2026-06-25: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# hash-collision DoS in InterfaceLookupFormatter](https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)