CVE-2026-48502
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- State
- Published
- Severity
- 8.2 High
- Published
- Jun 22, 2026
- Updated
- Jun 23, 2026
- Reserved
- May 21, 2026
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-125 Out-of-bounds Read
- CWE-190 Integer Overflow or Wraparound
- CWE-407 Inefficient Algorithmic Complexity
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
- CWE-502 Deserialization of Untrusted Data
- CWE-674 Uncontrolled Recursion
- CWE-789 Memory Allocation with Excessive Size Value
- CWE-1188 Insecure Default Initialization of Resource
Affected Products
| Product | Versions |
|---|---|
MessagePack-CSharpMessagePack-CSharp |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.