EUVD-2026-38384
GHSA-cj9g-3mj2-g8vv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High complexity because specific JSON conversion APIs must be exposed to untrusted input; uncatchable process crash warrants A:H, not Low.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host processes via an uncatchable StackOverflowException, producing a denial-of-service condition in applications that route untrusted input through these APIs. Three independent recursive code paths - ConvertFromJson's FromJsonCore(), TinyJsonReader.ReadNextToken() (which recurses once per comma or colon character, enabling exploitation via malformed JSON), and the ConvertToJson ext-100 typeless extension branch - all bypass the library's existing MessagePackSecurity depth-limit enforcement. No public exploit has been identified at time of analysis, and only applications explicitly using the JSON conversion helpers (not normal typed MessagePack deserialization) are exposed.
Technical ContextAI
MessagePack-CSharp (CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:*) is a high-performance MessagePack serializer for .NET/C#, widely used in Unity game clients and .NET microservices. CWE-674 (Uncontrolled Recursion) describes the root cause: the library exposes a JSON conversion subsystem (ConvertFromJson, ConvertToJson, TinyJsonReader) that is architecturally separate from its primary typed deserialization path. The library already implements a depth-guard mechanism via MessagePackSecurity.MaximumObjectGraphDepth and the DepthStep(ref reader) call pattern, but these three JSON conversion code paths inconsistently apply - or entirely skip - those guards. Because .NET's CLR terminates the process immediately on stack exhaustion without allowing catch handlers to intercept, a StackOverflowException cannot be caught at the application layer, making any compensating try/catch logic ineffective as a workaround.
RemediationAI
Upgrade to MessagePack-CSharp 2.5.301 (v2 branch) or 3.1.7 (v3 branch), as confirmed by the vendor advisory at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-cj9g-3mj2-g8vv. These releases patch all three recursive code paths by consistently applying MessagePackSecurity.MaximumObjectGraphDepth and DepthStep() checks. If an immediate upgrade is not feasible, the most effective compensating control is to audit all call sites for ConvertFromJson, ConvertToJson, and any direct use of TinyJsonReader, and ensure no attacker-controlled data reaches these methods - route untrusted input through typed MessagePack deserialization instead. Adding application-level input size or nesting-depth validation before these calls can reduce risk, but cannot fully prevent exploitation via the separator-recursion path in TinyJsonReader since it exploits character counts rather than structural depth. Migrating away from the JSON conversion helpers for untrusted input is preferable to relying on input filtering as a long-term control.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today