Executive brief
MessagePack-CSharp is a library used to exchange data between applications. A flaw in how it handles multi-dimensional arrays allows an attacker to send a specially crafted small message that forces the application to allocate massive amounts of memory. This can lead to the application crashing, being shut down by the operating system, or becoming unresponsive, resulting in a denial-of-service.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) within the multi-dimensional array formatters (2D, 3D, and 4D). The root cause is that the `Deserialize` methods in `TwoDimensionalArrayFormatter<T>`, `ThreeDimensionalArrayFormatter<T>`, and `FourDimensionalArrayFormatter<T>` read dimension lengths directly from the MessagePack payload and perform heap allocation before validating that the total element count matches the actual data provided. An attacker can provide a small payload with very large dimension integers, causing the library to attempt a massive allocation. This results in OutOfMemoryExceptions, high CPU usage due to zero-initialization, or process termination. The issue is fixed in versions 2.5.301 and 3.1.7.
Affected products
- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory reviewed and updated