MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's
    JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit.
    These paths are in the JSON conversion component rather than normal typed MessagePack deserialization.
    MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in
    FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth.
    TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even
    malformed JSON with long separator runs to consume one stack frame per character.
    MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension
    branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref
    reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an
    uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception.
    This vulnerability is fixed in 2.5.301 and 3.1.7. (CVE-2026-48512)

ID	Name	Product	Family	Type	Severity
459545	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459545	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443957	SCA: security update for MessagePack (GHSA-cj9g-3mj2-g8vv)	Tenable Cloud Security	SCA Checks	Local	medium
443957	SCA: security update for MessagePack (GHSA-cj9g-3mj2-g8vv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48512

medium

Tenable Plugins

medium

medium

medium

medium