CVE-2026-48512 (Low) detected in messagepack.3.1.4.nupkg

[mend-bolt-for-github]

CVE-2026-48512 - Low Severity Vulnerability

Vulnerable Library - messagepack.3.1.4.nupkg

Extremely Fast MessagePack(MsgPack) Serializer for C# (.NET Framework, .NET 6, Unity, Xamarin).

Library home page: https://api.nuget.org/packages/messagepack.3.1.4.nupkg

Path to dependency file: /src/SharpConnector.Tests/SharpConnector.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/messagepack/3.1.4/messagepack.3.1.4.nupkg,/home/wss-scanner/.nuget/packages/messagepack/3.1.4/messagepack.3.1.4.nupkg,/home/wss-scanner/.nuget/packages/messagepack/3.1.4/messagepack.3.1.4.nupkg

Dependency Hierarchy:

• enyimmemcachedcore.3.5.0.nupkg (Root Library)
  • ❌ messagepack.3.1.4.nupkg (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These paths are in the JSON conversion component rather than normal typed MessagePack deserialization. MessagePackSerializer.ConvertFromJson recursively processes nested JSON arrays and objects in FromJsonCore() without consulting MessagePackSecurity.MaximumObjectGraphDepth. TinyJsonReader.ReadNextToken() recursively consumes comma and colon separator characters, allowing even malformed JSON with long separator runs to consume one stack frame per character. MessagePackSerializer.ConvertToJson applies depth checks to arrays and maps, but the typeless extension branch for ext-100 recursively calls ToJsonCore() without applying MessagePackSecurity.DepthStep(ref reader). Each path can allow attacker-controlled input to exhaust the process stack and trigger an uncatchable StackOverflowException instead of failing with a catchable parse or serialization exception. This vulnerability is fixed in 2.5.301 and 3.1.7.

Publish Date: 2026-06-22

URL: CVE-2026-48512

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj9g-3mj2-g8vv

Release Date: 2026-06-22

Fix Resolution: messagepack - 3.1.7,messagepack - 2.5.301,MessagePack - 2.5.301,MessagePack - 3.1.7

---

Step up your Open Source Security Game with Mend here