Deserialization of attacker‑controlled MessagePack data as System.Object using PrimitiveObjectFormatter triggers the allocation of large object arrays before depth limits reject input. The nested array headers can reuse unread bytes, allowing a small payload to force many large arrays into memory at once, exhausting managed heap space, triggering heavy garbage collection, and eventually terminating the process or causing loss of service.

The flaw exists in MessagePack‑CSharp before versions 2.5.303 and 3.1.9. Applications that use MessagePack serialization on the server side—such as ASP.NET Core applications with AddMessagePackProtocol() enabled, or any code that deserializes untrusted data via PrimitiveObjectFormatter—are vulnerable. The affected component improperly handles array length limits during deserialization.

The CVSS score is 5.3, denoting moderate impact. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Because the entry requires attacker‑controlled MessagePack data to be processed, the attack vector is likely remote and application‑level; repeated submissions of crafted packets can exhaust memory and bring the process to a halt. Given the moderate CVSS and potential denial‑of‑service outcome, it is prudent to treat the risk as significant for exposed endpoints.