MessagePack Security Flaw in C# Serializer by MessagePack

CVE-2026-48506

What is CVE-2026-48506?

A critical flaw in the MessagePack for C# serializer allows recursive descent into nested arrays and maps without depth limitation. This behavior circumvents the maximum object graph depth checks intended to prevent excessive resource consumption. Exploiting this vulnerability could lead to unbounded recursion, resulting in a StackOverflowException. Users are encouraged to upgrade to versions 2.5.301 and 3.1.7 or later to mitigate this risk. For further information, consult the official advisory.

References