# CVE-2026-48512: MessagePack for C# uncontrolled recursion in JSON conversion helpers

Source: https://junglewise.ai/threats/cve-2026-48512-messagepack-for-c-uncontrolled-recursion-in-json-conversion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48512 · Severity: medium · CVSS 4 · Published 2026-06-22

MessagePack-CSharp is a library used to convert data between JSON and the MessagePack format. A vulnerability in its conversion tools allows an attacker to send specially crafted, deeply nested data that causes the application to crash. This can lead to a denial-of-service (DoS) condition, impacting the availability of services like gateways or logging tools that process external data.

Technologies: [MessagePack-CSharp MessagePack for C#](https://junglewise.ai/threats/technologies/messagepack-for-c), [MessagePack-CSharp](https://junglewise.ai/threats/technologies/messagepack-csharp), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48512 being exploited in the wild.

**How severe is CVE-2026-48512?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.

**Is there a fix for CVE-2026-48512?** Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48512 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48512?** Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 2.5.301 or later

  ```sh
  dotnet add package MessagePack --version 2.5.301
  ```


## Technical details

The vulnerability consists of three uncontrolled recursion issues within the JSON conversion component of MessagePack-CSharp. Specifically, 'MessagePackSerializer.ConvertFromJson' fails to consult depth limits during nested object processing, 'TinyJsonReader.ReadNextToken' recursively consumes separators, and 'MessagePackSerializer.ConvertToJson' lacks depth enforcement for typeless extension branches. An attacker can exploit these by providing deeply nested JSON or malformed separator runs, triggering an uncatchable 'StackOverflowException'. This bypasses 'MessagePackSecurity.UntrustedData' protections. Patches are available in versions 2.5.301 and 3.1.7.

## Affected products

- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48512
- GHSA-cj9g-3mj2-g8vv

## Timeline

- 2026-06-09: disclosed: Advisory published by maintainer
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: advisory: GitHub Advisory Database publication date

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# hash-collision DoS in InterfaceLookupFormatter](https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)