Executive brief
MessagePack-CSharp is a library used to serialize and deserialize data for high-performance applications. A flaw in how it handles certain complex data structures (unions) allows an attacker to bypass security limits on data depth. By sending a specially crafted, deeply nested message, an attacker can cause the application to crash, leading to a denial of service.
Technical details
The DynamicUnionResolver in MessagePack-CSharp fails to emit IL code that calls MessagePackSecurity.DepthStep and decrements reader.Depth during recursive deserialization or when skipping unknown union keys. This omission allows an attacker to bypass configured maximum object graph depth limits by providing a union payload with an unknown key and a deeply nested value. When processed, the recursive skip behavior can exhaust the stack, resulting in an uncatchable StackOverflowException. The vulnerability is specific to the runtime-generated deserializers for [Union]-decorated interfaces and abstract classes. Patches are available in versions 2.5.301 and 3.1.7.
Affected products
- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication
- 2026-06-25: patched: GitHub Advisory published/reviewed