DynamicUnionResolver emits deserializers that skip depth enforcement checks when processing union data. The deserialization of attacker‑controlled data can bypass the library’s maximum object graph depth enforcement, allowing deep or recursive structures that may cause excessive memory consumption or stack overflows. This weakness can lead to denial of service or resource exhaustion for applications that accept untrusted MessagePack payloads.

Any project using MessagePack‑CSharp prior to version 2.5.301 or 3.1.7, such as the MessagePack‑CSharp library itself. The vulnerability is present in all impacted releases until the specified fixed versions are deployed.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it when they supply crafted MessagePack data to an application that uses DynamicUnionResolver without patching; the lack of depth checks is the primary exploitation vector and requires a remote attacker to influence the payload being deserialized.