Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, described as 'Typeless deserialization type restrictions do not recurse into arrays or generic arguments', is addressed in commit 826f17c78f2e21c83425c51257056ec5c29c5ff9. The analysis of this commit reveals that the MessagePack.MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed method was modified to perform a recursive check on nested types. Previously, the method only checked the top-level type being deserialized, allowing a security bypass. The patch introduces a new ThrowIfDeserializingTypeIsDisallowedCore method to check a single type, and the original ThrowIfDeserializingTypeIsDisallowed method is updated to recursively call itself for array element types and generic type arguments. This directly corresponds to the vulnerability description. The vulnerable function is the pre-patch version of MessagePack.MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed which lacks this recursive validation, enabling an attacker to deserialize disallowed types when they are nested within other types.
MessagePack.MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowedsrc/MessagePack.UnityClient/Assets/Scripts/MessagePack/MessagePackSerializerOptions.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| MessagePack | nuget | < 2.5.301 | 2.5.301 |
| MessagePack | nuget | >= 3.0, < 3.1.7 | 3.1.7 |