Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Medium 6.3
In plain English
A medium-severity unsafe deserialization in MessagePack-CSharp from MessagePack-CSharp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | messagepack | 2.5.301 | GHSA-qhmf-xw27-6rqr |
| NuGet | messagepack | 3.1.7 | GHSA-qhmf-xw27-6rqr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MessagePack-CSharp | MessagePack-CSharp | >= 3.0, < 3.1.7< 2.5.301 |
Weakness: CWE-470, CWE-502 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N