CVE-2026-48513

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description Runtime-generated union deserializers emitted by DynamicUnionResolver fail to call MessagePackSecurity.DepthStep(ref reader) and do not decrement reader.Depth during recursive deserialization and skip paths. Consequently, union deserialization does not consistently adhere to the maximum object graph depth enforcement used in other recursive formatter paths. When encountering unknown union keys, the emitted deserializer executes reader.Skip() on attacker-controlled data without an enclosing depth step.

Recommendations Update to version 2.5.301. Update to version 3.1.7.