Vulnerability in Messagepack
CVE-2026-48512
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (32.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 32.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Messagepack
- Messagepack-Csharp — versions >= 3.1.7, < 3.1.7, >= 3.0, < 3.1.7, < 2.5.301
Weakness classification (CWE)
References
- github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-cj9g-… (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-48512?
- CVE-2026-48512 is a high-severity vulnerability in Messagepack, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-06-22.
- How severe is CVE-2026-48512?
- High severity. CVSS v3 base score is 7.5 out of 10.