Medium

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

Type: advisorySources: OSV

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-48512
Confirmed fixed CVEs: Not specified
Updated in this feed: 3 Nov 2026, 07:45 UTC · Revision 1

Source evidence

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

core-osv · Original source

Published 22 Jun 2026, 21:14 UTC

osv:CVE-2026-48512

Complete source record

{
  "id": "8f68dfb1a23fa72d694030ee9ec9b6154f71f88cd1dd4f3756a0d2a170af89aa",
  "url": "https://osv.dev/vulnerability/CVE-2026-48512",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement",
    "summary": "MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.",
    "evidence": "osv:CVE-2026-48512",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-48512",
      "aliases": [
        "CVE-2026-48512",
        "GHSA-cj9g-3mj2-g8vv"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/messagepack-csharp/messagepack-csharp",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5657b1e34ea2869a2ca6bc0aa6617158620201ba"
                },
                {
                  "introduced": "ff3af77f546138d9da71707baddf2c30f55dfc15"
                },
                {
                  "fixed": "1b53ae8b7681340199faf337bcbb0eb5aed702de"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\\#:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.5.301"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\\#:*:*",
                    "range": [
                      {
                        "introduced": "3.0.3"
                      },
                      {
                        "fixed": "3.1.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.1.6",
            "v3.1.5",
            "v2.5.198",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0",
            "v3.0.301",
            "v3.0.300",
            "v3.0.3",
            "v2.5.192",
            "v2.5.187",
            "v2.5.172",
            "v2.5.171",
            "v2.5.168",
            "v2.5.140",
            "v2.5.129",
            "v2.5.108",
            "v2.5.124",
            "v2.5.103",
            "v2.4.59",
            "v2.5.94",
            "v2.4.35",
            "v2.4.23-alpha",
            "v2.3.85",
            "v2.1.115",
            "v2.3.75",
            "v2.2.113",
            "v2.2.85",
            "v2.2.60",
            "v2.1.194",
            "v2.1.165",
            "v2.1.152",
            "v2.1.143",
            "v2.1.90",
            "v2.1.80",
            "v2.0.270-rc",
            "v2.0.204-beta",
            "v2.0.123-beta",
            "v2.0.119-beta",
            "v2.0.110-alpha",
            "v2.0.94-alpha",
            "v1.7.3.4",
            "v1.7.3.3",
            "v1.7.3.2",
            "v1.7.3.1",
            "v1.7.3",
            "v1.7.2",
            "v1.7.0",
            "v1.6.2",
            "v1.6.1.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.4",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.3",
            "v1.2.1",
            "v1.2.0",
            "v1.1.2",
            "v1.1.1",
            "v1.0.3",
            "v1.0.2",
            "1.0.1",
            "0.2.0-beta",
            "0.1.0-beta"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48512.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.685455136Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48512.json",
        "https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-cj9g-3mj2-g8vv",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-48512"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-674"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48512.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-48512",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493477,
  "published_at": "2026-06-22T21:14:20.241+00:00"
}