EUVD-2026-38382
GHSA-w567-gjr2-hm5j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth needed, but AC:H because only specific UnsafeBlitFormatter usage triggers it; impact is availability-only via memory exhaustion.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used to constrain the inner byteLength before allocation. A very small payload can therefore request a very large T[] allocation. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Unchecked large-array allocation in MessagePack for C
exposes any .NET application deserializing untrusted MessagePack extension payloads to a denial-of-service condition. The UnsafeBlitFormatterBase<T>.Deserialize method trusts an attacker-supplied byteLength field from the inner extension payload and allocates a T[] array of that size before comparing it against the outer extension header length or remaining input bytes, meaning a few-byte payload can trigger gigabyte-scale allocations. No active exploitation has been confirmed (no CISA KEV listing, no public exploit identified at time of analysis), but the attack requires no authentication and no user interaction, lowering the bar for any attacker with network access to an exposed endpoint.
Technical ContextAI
MessagePack is a compact binary serialization format, and MessagePack for C
is the canonical .NET implementation used heavily in Unity game development, ASP.NET microservices, and high-performance RPC frameworks. The affected code path, UnsafeBlitFormatterBase<T>, is a performance-optimized formatter that uses unsafe memory operations to deserialize blittable structs directly. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the deserializer reads a byteLength value controlled by the serialized payload and immediately passes it to array allocation logic without first clamping it to the number of bytes actually available in the input stream. The outer MessagePack extension header is correctly bounded by the input buffer, but that bound is never propagated inward to constrain the byteLength read from the extension body, creating a trivially triggerable amplification between payload size and allocated memory. Affected products are identified via CPE cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:*.
RemediationAI
The vendor-released patches are version 2.5.301 (for 2.x users) and version 3.1.7 (for 3.x users); upgrade to the appropriate patched release as the primary remediation. If an immediate upgrade is not feasible, the most effective compensating control is to ensure that any endpoint accepting MessagePack data from untrusted sources enforces a maximum request body size at the network or application framework layer (e.g., ASP.NET Core's MaxRequestBodySize or equivalent), which limits the number of allocation attempts an attacker can trigger per connection. Additionally, restricting access to MessagePack deserialization endpoints to authenticated or network-allowlisted clients reduces exposure, though the CVSS PR:N rating means this is a workaround rather than a fix. Note that the vulnerability is specific to types using UnsafeBlitFormatterBase<T>, so auditing which types in your application use this formatter can help scope risk. Full advisory and patch references: https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-w567-gjr2-hm5j.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today