EUVD-2026-38363
GHSA-qhmf-xw27-6rqr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires typeless deserialization mode and attacker-controlled payload (AC:H); no scope change; integrity-only impact per advisory.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array or constructed generic type and pass the outer type check. The formatter machinery can then materialize formatters for the inner blocked type. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or generic type constructs, bypassing the ThrowIfDeserializingTypeIsDisallowed safety check. Applications using typeless deserialization on MessagePack-CSharp prior to versions 2.5.301 (2.x branch) and 3.1.7 (3.x branch) are exposed. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity and the prerequisite that typeless deserialization must be enabled and attacker-controlled input must reach the deserializer.
Technical ContextAI
MessagePack-CSharp is a .NET implementation of the MessagePack binary serialization format, widely used in Unity game development, ASP.NET microservices, and high-performance .NET applications. The vulnerability resides in the typeless deserialization path, where serialized data carries embedded type names that the library resolves at runtime - analogous to BinaryFormatter-style deserialization risks. The safety guard ThrowIfDeserializingTypeIsDisallowed(Type) performs a blocklist check on the outer resolved type name but fails to recurse into array element types or generic type arguments (e.g., List<BlockedType> or BlockedType[]). The formatter machinery subsequently materializes formatters for these unscrutinized inner types, effectively instantiating types the blocklist was designed to prevent. CWE-470 (Use of Externally-Controlled Input to Choose Classes or Code) captures the root cause: attacker-supplied type names from the payload drive class instantiation via reflection, and the incomplete blocklist traversal is the exploitable gap. Affected CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patches are available: upgrade to MessagePack-CSharp 2.5.301 (for 2.x users) or 3.1.7 (for 3.x users). Both fix versions are confirmed by the vendor in GitHub Security Advisory GHSA-qhmf-xw27-6rqr at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhmf-xw27-6rqr. If immediate patching is not possible, the most effective compensating control is to disable typeless deserialization entirely and migrate to typed deserialization, which does not rely on ThrowIfDeserializingTypeIsDisallowed and avoids the vulnerability class altogether - though this requires application-level refactoring. Alternatively, restricting MessagePack deserialization endpoints to authenticated, trusted callers reduces the network attack surface, but does not eliminate the vulnerability. Input validation at the serialized payload boundary is not a reliable mitigation given the recursive type-wrapping nature of the bypass.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today