CVE-2026-44375 Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
A malicious MessagePack payload can trigger a StackOverflowException via uncontrolled stack allocation, crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44375?
CVE-2026-44375 is a high-severity denial of service vulnerability in AArnott Nerdbank.MessagePack, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.
Weakness: CWE-789
Which versions are affected by CVE-2026-44375?
2 open source packages ship an affected version, including Nerdbank.MessagePack.
| Package | Affected | Fixed in |
|---|---|---|
Nerdbank.MessagePack NuGet | All versions | 1.1.62 |
Nerdbank.MessagePack NuGet | All versions | 1.1.62 |
How do I fix CVE-2026-44375?
Upgrade Nerdbank.MessagePack to 1.1.62 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44375 being exploited?
There is no known exploitation of CVE-2026-44375 in the wild and no public exploit code.
Sources
Also known as GHSA-2cwq-pwfr-wcw3.