CVE-2026-48512

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. Specifically, the MessagePackSerializer.ConvertFromJson function recursively processes nested JSON arrays and objects within FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. Additionally, TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, which allows malformed JSON with long separator runs to consume one stack frame per character. Furthermore, while MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). These issues allow attacker-controlled input to exhaust the process stack, triggering an uncatchable StackOverflowException instead of a catchable parse or serialization exception.

Recommendations Update to version 2.5.301. Update to version 3.1.7.