Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-wfr3-xj75-pfwh, exists in the MessagePack-CSharp library and pertains to uncontrolled recursion. The core of the issue lies within the DynamicUnionResolver, which is responsible for generating deserializers for union types at runtime. According to the vulnerability description, the generated deserializers do not properly enforce depth limits. Specifically, they fail to call MessagePackSecurity.DepthStep(ref reader) when processing union types. This omission allows a specially crafted message with deeply nested unions to cause a StackOverflowException, leading to a denial of service. The vulnerable function is MessagePack.Resolvers.DynamicUnionResolver.BuildDeserialize, as it is responsible for emitting the insecure IL code for the deserializer. An attacker can exploit this by sending a payload that the application deserializes into an object graph containing [Union]-decorated types, triggering the uncontrolled recursion.
MessagePack.Resolvers.DynamicUnionResolver.BuildDeserializesrc/MessagePack/Resolvers/DynamicUnionResolver.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| MessagePack | nuget | < 2.5.301 | 2.5.301 |
| MessagePack | nuget | >= 3.0, < 3.1.7 | 3.1.7 |