MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

Summary

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.

Timeline

1. Jun 22, 2026, 9:18 PM UTCCVE published
2. Jun 23, 2026, 2:58 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 23, 2026, 3:05 PM UTCRecord last updated

Affected versions

• MessagePack-CSharp MessagePack-CSharp

  From 3.1.7 · fixed in 3.1.7; fixed in 2.5.301

• MessagePackNuGet

  From 3.0 · fixed in 3.1.7

References 1