# CVE-2026-48513: MessagePack for C# uncontrolled recursion in DynamicUnionResolver

Source: https://junglewise.ai/threats/cve-2026-48513-messagepack-for-c-uncontrolled-recursion-in-dynamicunionresolver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48513 · Severity: medium · CVSS 4 · Published 2026-06-22

MessagePack-CSharp is a library used to serialize and deserialize data for high-performance applications. A flaw in how it handles certain complex data structures (unions) allows an attacker to bypass security limits on data depth. By sending a specially crafted, deeply nested message, an attacker can cause the application to crash, leading to a denial of service.

Technologies: [MessagePack-CSharp](https://junglewise.ai/threats/technologies/messagepack-csharp), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48513 being exploited in the wild.

**How severe is CVE-2026-48513?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.

**Is there a fix for CVE-2026-48513?** Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48513?** Check whether you run MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 2.5.301 or later

  ```sh
  dotnet add package MessagePack --version 2.5.301
  ```


## Technical details

The DynamicUnionResolver in MessagePack-CSharp fails to emit IL code that calls MessagePackSecurity.DepthStep and decrements reader.Depth during recursive deserialization or when skipping unknown union keys. This omission allows an attacker to bypass configured maximum object graph depth limits by providing a union payload with an unknown key and a deeply nested value. When processed, the recursive skip behavior can exhaust the stack, resulting in an uncatchable StackOverflowException. The vulnerability is specific to the runtime-generated deserializers for [Union]-decorated interfaces and abstract classes. Patches are available in versions 2.5.301 and 3.1.7.

## Affected products

- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48513
- GHSA-wfr3-xj75-pfwh

## Timeline

- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication
- 2026-06-25: patched: GitHub Advisory published/reviewed

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# hash-collision DoS in InterfaceLookupFormatter](https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)