Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
High 8.2
In plain English
A high-severity out-of-bounds read in MessagePack-CSharp from MessagePack-CSharp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | messagepack | 3.1.7 | GHSA-382j-8mxh-c7x2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MessagePack-CSharp | MessagePack-CSharp | >= 3.1.7, < 3.1.7< 2.5.301 |
Weakness: CWE-125, CWE-190, CWE-407, CWE-409, CWE-470, CWE-502, CWE-674, CWE-789, CWE-1188 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N