CVE-2026-48515 MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
Attackers can cause excessive memory allocation and denial of service by sending crafted payloads with large declared dimensions to MessagePack-CSharp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48515?
CVE-2026-48515 is a medium-severity denial of service vulnerability in MessagePack-CSharp, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the target multi-dimensional array happens before the dimensions are checked against that element count. A small payload can therefore declare large dimensions, provide an empty or tiny inner array, and cause a large heap allocation before element data is validated. This vulnerability is fixed in 2.5.301 and 3.1.7.
Weakness: CWE-770
Which versions are affected by CVE-2026-48515?
4 open source packages ship an affected version, including MessagePack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MessagePack NuGet | All versions | 2.5.301 |
MessagePack NuGet | All versions | 2.5.301 |
MessagePack NuGet | From 3.0 | 3.1.7 |
MessagePack NuGet | From 3.0 | 3.1.7 |
Products include Messagepack Messagepack.
How do I fix CVE-2026-48515?
Upgrade MessagePack to a fixed version for your release line: 2.5.301 or 3.1.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48515 being exploited?
There is no known exploitation of CVE-2026-48515 in the wild and no public exploit code.
Other vulnerabilities in MessagePack-CSharp
- CVE-2026-48109 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
- CVE-2026-48502 MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- CVE-2026-48506 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
- CVE-2026-48509 MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
- CVE-2026-48510 MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Sources
Also known as ECHO-6659-05ea-af1c, GHSA-cxmj-83gh-fp49.