MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6 reader.Skip recursion

Summaryinfo

A vulnerability has been found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6 and classified as problematic. This vulnerability affects the function reader.Skip. Performing a manipulation results in recursion. This vulnerability is reported as CVE-2026-48513. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6. This affects the function reader.Skip. The manipulation with an unknown input leads to a recursion vulnerability. CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. This is going to have an impact on availability. The summary by CVE is:

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth around recursive deserialization and skip paths. This means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls reader.Skip() on attacker-controlled data without an enclosing depth step. This vulnerability is fixed in 2.5.301 and 3.1.7.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-48513 since 05/21/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 2.5.301 or 3.1.7 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• MessagePack-CSharp

Name

• MessagePack for C#

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.300
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion