MessagePack Serializer for C# Vulnerability in UnsafeBlitFormatterBase

CVE-2026-48514

What is CVE-2026-48514?

The MessagePack for C# library, a widely used serializer in the C# ecosystem, contains a deserialization flaw in the UnsafeBlitFormatterBase class. Prior to versions 2.5.301 and 3.1.7, the library fails to properly validate the byte length retrieved from an attacker-controlled extension payload before allocating an array. As a result, a small payload could mislead the deserialization process to request a disproportionately large array allocation, leading to potential denial-of-service conditions or resource exhaustion. Users are advised to update to the latest versions to mitigate these risks.

References