CVE-2026-48515

MessagePack for C# prior to versions 2.5.301 and 3.1.7 uses default serialization options that can lead to denial-of-service attacks. The default MessagePackInputFormatter() constructor is insecure as it may expose applications to hash-collision attacks against dictionary-like model properties.

The MessagePack library for C# has a vulnerability related to type deserialization that does not recursively check array element types or generic type arguments. This can lead to a situation where a dangerous type that should be blocked can be deserialized if wrapped in an array or generic type.

The MessagePack library for C# has a vulnerability related to the construction of an internal dictionary with the default equality comparer. Versions prior to 2.5.301 and 3.1.7 are susceptible to denial of service attacks using hash collisions.

In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, there is a vulnerability that allows reading an attacker-controlled byteLength from an extension payload. This can lead to allocating a large T[] array without proper validation, potentially causing memory allocation issues.

In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, a vulnerability exists related to union deserialization that does not enforce object depth limits. Runtime-generated deserializers do not call necessary security steps, leading to potential security issues.

MessagePack for C# prior to versions 2.5.301 and 3.1.7 contains multiple recursion paths in the JSON conversion components that do not enforce a depth limit. These paths can lead to process stack exhaustion and trigger an uncatchable StackOverflowException.

MessagePack for C# has a vulnerability in the ExpandoObjectFormatter's Deserialize method that can lead to significant CPU and memory overhead when handling large attacker-controlled maps. This issue exists prior to versions 2.5.301 and 3.1.7.

MessagePack for C# has a vulnerability that allows improper memory allocations during the decompression of Lz4Block or Lz4BlockArray data. Prior to versions 2.5.301 and 3.1.7, the validity of compressed data was not checked before allocating output buffers.

MessagePack for C# has a vulnerability that allows recursive descent into nested arrays and maps without proper depth checks. This can lead to unbounded recursion and a StackOverflowException.

In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, the MessagePackReader.ReadDateTime() method can allocate stack memory based on an attacker-controlled extension length. In the slow path for timestamp extension parsing, the extension body length is not validated before memory allocation, potentially leading to a StackOverflowException.