CVE-2026-48517

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description Typeless deserialization in MessagePack-CSharp uses MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) to prevent the deserialization of dangerous types. However, the default implementation only verifies the outer type name and fails to recursively inspect generic type arguments or array element types. This allows a blocked type to bypass the safety check if it is wrapped within a generic type or an array, enabling the formatter machinery to materialize formatters for the restricted inner type.

Recommendations Update MessagePack for C# to version 2.5.301 or later. Update MessagePack for C# to version 3.1.7 or later.