CVE-2026-48512: MessagePack for C# uncontrolled recursion in JSON conversion helpers

Executive brief

MessagePack-CSharp is a library used to convert data between JSON and the MessagePack format. A vulnerability in its conversion tools allows an attacker to send specially crafted, deeply nested data that causes the application to crash. This can lead to a denial-of-service (DoS) condition, impacting the availability of services like gateways or logging tools that process external data.

Technical details

The vulnerability consists of three uncontrolled recursion issues within the JSON conversion component of MessagePack-CSharp. Specifically, 'MessagePackSerializer.ConvertFromJson' fails to consult depth limits during nested object processing, 'TinyJsonReader.ReadNextToken' recursively consumes separators, and 'MessagePackSerializer.ConvertToJson' lacks depth enforcement for typeless extension branches. An attacker can exploit these by providing deeply nested JSON or malformed separator runs, triggering an uncatchable 'StackOverflowException'. This bypasses 'MessagePackSecurity.UntrustedData' protections. Patches are available in versions 2.5.301 and 3.1.7.

Affected products

• MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Timeline

• 2026-06-09: disclosed: Advisory published by maintainer
• 2026-06-22: advisory: NVD publication date
• 2026-06-25: advisory: GitHub Advisory Database publication date

References

• https://api.github.com/users/AArnott
• https://github.com/AArnott
• https://api.github.com/users/AArnott/gists%7B/gist_id%7D
• https://api.github.com/users/AArnott/repos
• https://avatars.githubusercontent.com/u/3548?v=4
• https://api.github.com/users/AArnott/events%7B/privacy%7D