EUVD-2026-38389
GHSA-382j-8mxh-c7x2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated DoS; AC:H because the consumer must invoke the timestamp slow path on attacker data; only availability impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Denial of service in MessagePack for C
versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host processes by sending a crafted MessagePack timestamp extension payload that triggers an uncatchable StackOverflowException. The flaw stems from a stackalloc operation using an attacker-controlled extension length before validation, enabling a tiny payload to claim a massive stack allocation. No public exploit identified at time of analysis, and CVSS 4.0 of 8.2 reflects high availability impact with attack complexity requirements.
Technical ContextAI
MessagePack for C
is a high-performance binary serializer widely used in .NET applications, games (Unity), and microservices for compact data interchange. The vulnerability lives in MessagePackReader.ReadDateTime() inside the slow path for timestamp extension parsing: the routine computes tokenSize from the on-wire extension body length and passes it directly to a stackalloc call before checking that the length matches one of the valid timestamp sizes (4, 8, or 12 bytes per the MessagePack timestamp extension spec). CWE-125 (out-of-bounds read) is the assigned weakness class, though the realized impact is actually an unbounded stack allocation that overruns the thread's stack - a stack-based resource exhaustion that .NET cannot catch, immediately terminating the entire process.
RemediationAI
Vendor-released patch: upgrade to MessagePack-CSharp 2.5.301 (2.x users) or 3.1.7 (3.x users) as documented in advisory GHSA-382j-8mxh-c7x2 (https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-382j-8mxh-c7x2). If immediate upgrade is not possible, restrict or reject MessagePack input from untrusted sources at the network or application boundary, enforce a strict maximum payload size on incoming MessagePack messages (which limits the attacker's ability to claim large extension bodies even before parsing), or wrap deserialization in a separate worker process that can be restarted on crash - trade-offs include latency overhead for the worker isolation approach and the fact that size limits do not strictly prevent the issue since the extension-length field is what is abused rather than total payload size. Disabling timestamp extension parsing is not an exposed configuration option, so patching is strongly preferred.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today