MessagePack-CSharp contains recursive JSON conversion helpers that fail to enforce a consistent depth limit across all code paths. The ConvertFromJson routine recursively processes nested JSON arrays and objects without consulting the library’s global maximum object graph depth setting, while TinyJsonReader.ReadNextToken recursively consumes separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. Similar problems exist in ConvertToJson for typeless extension branches. An attacker who supplies specially crafted JSON can therefore exhaust the .NET process stack, resulting in an uncatchable StackOverflowException and effectively a denial‑of‑service condition.

This issue affects the MessagePack-CSharp library published by MessagePack‑CSharp. Versions earlier than 2.5.301 and 3.1.7 are vulnerable. Clients using these libraries for JSON serialization or deserialization that accept untrusted input should treat the environment as potentially exposed until a patch is applied.

The CVSS score of 6.3 indicates medium severity, but the lack of an EPSS score makes exploitation likelihood unclear. Because the vulnerability is tied to rich JSON processing, any service that performs JSON conversion via MessagePack-CSharp and receives user‑controlled data is a valid target. No known exploit is tracked in KEV, and the StackOverflow exception cannot be caught by application code, so the effect is a permanent crash of the hosting process. Local or remote code execution is not achieved, but the vulnerability can be abused to consume resources and disrupt availability.