CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits
Attackers can cause denial of service via excessive memory allocation when deserializing nested arrays in MessagePack for C#.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92707?
CVE-2026-92707 is a medium-severity denial of service vulnerability in MessagePack-CSharp, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
Weakness: CWE-1325
Which versions are affected by CVE-2026-92707?
4 open source packages ship an affected version, including MessagePack.
| Package | Affected | Fixed in |
|---|---|---|
MessagePack NuGet | All versions | 2.5.303 |
MessagePack NuGet | All versions | 2.5.303 |
MessagePack NuGet | From 3.0.0 | 3.1.9 |
MessagePack NuGet | From 3.0.0 | 3.1.9 |
How do I fix CVE-2026-92707?
Upgrade MessagePack to a fixed version for your release line: 2.5.303 or 3.1.9.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92707 being exploited?
There is no known exploitation of CVE-2026-92707 in the wild and no public exploit code.
Sources
Also known as ECHO-2222-717f-2f28, GHSA-qhrr-8q5h-9q3h, UBUNTU-CVE-2026-92707.