CVE-2026-48506

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description The MessagePackReader.TrySkip() function recursively descends into nested arrays and maps without incrementing the reader depth or triggering configured depth checks. This behavior bypasses MessagePackSecurity.MaximumObjectGraphDepth, which is the mechanism designed to protect against deeply nested object graphs. Because many generated and dynamic formatters utilize reader.Skip() when encountering unknown map keys, unknown array members, ignored fields, or data intended for forward compatibility, a deeply nested value in these positions can lead to unbounded recursion and an uncatchable StackOverflowException.

Recommendations Update to version 2.5.301. Update to version 3.1.7.