EUVD-2026-38383
GHSA-wfr3-xj75-pfwh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires union-type deserialization path (AC:H); no credentials needed; impact strictly limited to availability via stack exhaustion.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Uncontrolled recursion in MessagePack for C
allows network-reachable attackers to crash applications by submitting deeply nested union-type payloads that bypass the library's object graph depth protection. DynamicUnionResolver's runtime-generated deserializers omit the required MessagePackSecurity.DepthStep calls, leaving union code paths entirely outside the recursion guard that protects all other formatter paths. No public exploit or active KEV listing exists at time of analysis, but any application deserializing untrusted MessagePack data via union types over a network endpoint is exposed to availability-only impact.
Technical ContextAI
MessagePack for C
is a high-performance binary serialization library for .NET. Its DynamicUnionResolver generates IL code at runtime to handle polymorphic deserialization for types decorated with the [Union] attribute. MessagePackSecurity provides a recursive depth-tracking mechanism requiring each formatter to call MessagePackSecurity.DepthStep(ref reader) before recursing and decrement reader.Depth afterward - this mechanism prevents stack exhaustion from deeply nested payloads. The flaw identified under CWE-674 (Uncontrolled Recursion) is that the IL emitted by DynamicUnionResolver omits both the DepthStep call and the Depth decrement, placing the entire union deserialization path outside depth enforcement. For unknown union discriminator keys, the emitted code additionally invokes reader.Skip() on attacker-supplied data with no enclosing depth step, compounding the bypass. The affected CPE is cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:* across all pre-fix releases on both v2 and v3 branches.
RemediationAI
Upgrade to MessagePack-CSharp 2.5.301 (v2.x branch) or 3.1.7 (v3.x branch), as confirmed by the vendor security advisory at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-wfr3-xj75-pfwh. If an immediate upgrade is not feasible, the most effective compensating control is to remove or avoid use of types decorated with the [Union] attribute in any deserialization path that processes untrusted input, which eliminates the vulnerable DynamicUnionResolver code path entirely. Alternatively, restrict access to the deserialization endpoint to trusted internal callers via network-layer controls, which limits the attacker surface without changing application behavior. Applications that deserialize MessagePack data exclusively from trusted, internal sources have significantly reduced exposure and may treat this as a routine patch cycle item. No side effects from the patch itself have been noted by the vendor.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today