EUVD-2026-38388
GHSA-vh6j-jc39-fggf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated payload to any MessagePack deserializer with no UI; impact is pure availability via uncatchable StackOverflowException, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps without incrementing the reader depth or calling the configured depth checks. This bypasses MessagePackSecurity.MaximumObjectGraphDepth, the library's documented protection against deeply nested object graphs. Many generated and dynamic formatters call reader.Skip() when they encounter unknown map keys, unknown array members, ignored fields, or data that should be skipped for forward compatibility. A deeply nested value in one of these skipped positions can therefore cause unbounded recursion and an uncatchable StackOverflowException. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Denial of service in MessagePack for C
versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash applications by sending deeply nested MessagePack payloads that trigger uncatchable StackOverflowException via MessagePackReader.TrySkip(). The flaw bypasses the library's own MaximumObjectGraphDepth safeguard because TrySkip() recurses into nested structures without incrementing the depth counter, making any application that deserializes untrusted MessagePack data exploitable. No public exploit identified at time of analysis, but the bug is straightforward to trigger and fixes are already published upstream.
Technical ContextAI
MessagePack for C
(messagepack-csharp) is a high-performance binary serializer widely used in .NET applications, Unity games, and gRPC-style RPC frameworks. The defect is rooted in CWE-674 (Uncontrolled Recursion): MessagePackReader.TrySkip() walks nested arrays and maps recursively on the managed call stack but does not call the configured depth checks, so MessagePackSecurity.MaximumObjectGraphDepth - the documented defense against hostile object graphs - is silently bypassed. Because generated and dynamic formatters routinely invoke reader.Skip() for unknown keys, ignored fields, and forward-compatibility padding, the unsafe path is reached during normal deserialization of any schema that tolerates unknown fields. A StackOverflowException in .NET cannot be caught and immediately terminates the process, turning the issue into a reliable DoS primitive against the affected CPE cpe:2.3:a:messagepack-csharp:messagepack-csharp.
RemediationAI
Vendor-released patch: upgrade to MessagePack for C
2.5.301 (2.x branch) or 3.1.7 (3.x branch) as documented in advisory GHSA-vh6j-jc39-fggf at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-vh6j-jc39-fggf. As a compensating control until packages can be updated, terminate untrusted MessagePack input at a boundary that enforces a hard byte-size cap and reject payloads above a conservative limit (for example a few hundred KB), since pathological nesting requires only a tiny amount of bytes per level and length limits sharply reduce achievable depth; note this does not fully eliminate the risk because deep nesting is byte-cheap. Additionally, host the deserializer in a process that can be quickly restarted (supervisord, Kubernetes liveness probe, IIS recycling) so a triggered StackOverflowException causes service blip rather than outage; this does not prevent the DoS, only shortens it. Setting MessagePackSecurity.MaximumObjectGraphDepth alone is NOT a workaround because the bug specifically bypasses that check.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today