CVE-2026-48513

MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement

Published Jun 22, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.

Analysis

Technical impact

DynamicUnionResolver emits deserializers that skip depth enforcement checks when processing union data. The deserialization of attacker‑controlled data can bypass the library’s maximum object graph depth enforcement, allowing deep or recursive structures that may cause excessive memory consumption or stack overflows. This weakness can lead to denial of service or resource exhaustion for applications that accept untrusted MessagePack payloads.

Affected Systems

Any project using MessagePack‑CSharp prior to version 2.5.301 or 3.1.7, such as the MessagePack‑CSharp library itself. The vulnerability is present in all impacted releases until the specified fixed versions are deployed.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it when they supply crafted MessagePack data to an application that uses DynamicUnionResolver without patching; the lack of depth checks is the primary exploitation vector and requires a remote attacker to influence the payload being deserialized.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MessagePack-CSharp

affected

Version	Status	Constraints
`>= 3.0, < 3.1.7`	affected	—
`< 2.5.301`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:messagepack:messagepack::::::c\#::*
	cpe:2.3:a:messagepack:messagepack::::::c\#::*

No data.

Vendor Product Versions

Messagepack

Messagepack-csharp

Version	Status	Scheme	Platform
`3.1.7`	affected	semver	—
`[0,2.5.301)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to MessagePack‑CSharp version 2.5.301 or later, or 3.1.7 or later.
If an immediate upgrade is not possible, disable DynamicUnionResolver for untrusted data or avoid deserializing unknown union keys until the patch is applied.
Consider implementing manual depth checks by calling MessagePackSecurity.DepthStep or a custom guard around deserialization of union types as an additional mitigative practice.

Generated by OpenCVE AI on June 22, 2026 at 23:27 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-wfr3-xj75-pfwh	MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.405% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Messagepack Messagepack messagepack-csharp
Vendors & Products		Messagepack Messagepack messagepack-csharp

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 22, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.
Title		MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement
Weaknesses		CWE-674
References		https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`