MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
References
| Link | Resource |
|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-382j-8mxh-c7x2 | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Jun 2026, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-382j-8mxh-c7x2 - Mitigation, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Messagepack messagepack
Messagepack |
|
| CPE | cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* |
22 Jun 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-22 22:16
Updated : 2026-06-23 17:25
NVD link : CVE-2026-48502
Mitre link : CVE-2026-48502
CVE.ORG link : CVE-2026-48502
JSON object : View
Products Affected
messagepack
- messagepack
CWE
CWE-125
Out-of-bounds Read
CWE-190Integer Overflow or Wraparound
CWE-407Inefficient Algorithmic Complexity
CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-502Deserialization of Untrusted Data
CWE-674Uncontrolled Recursion
CWE-789Memory Allocation with Excessive Size Value
CWE-1188Insecure Default Initialization of Resource