8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48502

CVE-2026-48502: MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48502

CVE-2026-48502:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
MessagePack	nuget	>= 3.0, < 3.1.7	3.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the MessagePack-CSharp library, specifically in the deserialization of DateTime objects. The core issue is an allocation of resources without limits (CWE-789). When deserializing a DateTime, the MessagePackReader.ReadDateTime function is called. This function, prior to the patch, would read an extension header length from the incoming data and use it to calculate the size for a stack allocation (stackalloc). The vulnerability lies in the fact that this length was not validated against the legitimate sizes for a timestamp (4, 8, or 12 bytes).

An attacker could craft a malicious MessagePack payload with a timestamp extension claiming a very large body length. When MessagePackReader.ReadDateTime processes this payload, it would attempt to allocate a large buffer on the stack, leading to a StackOverflowException. This exception is uncatchable and terminates the process, resulting in a denial of service.

The fix, identified in commit 26d4e743ca2a88a5626e62cced3762820e392325, was applied to the helper function MessagePack.MessagePackPrimitives.TryReadDateTime. The patch introduces a check to validate the extension length before any buffer allocation is attempted. If the length is not one of the valid sizes (4, 8, or 12), the operation is aborted, and an exception is thrown, preventing the stack overflow.

Therefore, any application using a vulnerable version of MessagePack-CSharp (>= 3.0, < 3.1.7) to deserialize untrusted data containing DateTime or DateTimeOffset values is at risk. During exploitation, a profiler would show the MessagePack.MessagePackReader.ReadDateTime function being called, which would then lead to the vulnerable code path and the subsequent crash.

Vulnerable functions

MessagePack.MessagePackReader.ReadDateTime

src/MessagePack/MessagePackReader.cs

This is the primary public API for reading a DateTime value. Before the patch, it would call internal methods that failed to validate the length of a timestamp extension from the input data. An attacker could provide a large, invalid length, which would be used to calculate the size for a stack allocation, leading to a stack overflow and process termination.

MessagePack.MessagePackPrimitives.TryReadDateTime

src/MessagePack/MessagePackPrimitives.Readers.cs

This internal helper function contains the core logic for parsing DateTime values and is where the vulnerability was patched. It is called by `MessagePackReader.ReadDateTime`. The function failed to validate the `header.Length` property before it was used in a size calculation for a subsequent stack allocation, allowing an attacker-controlled value to cause a stack overflow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.