Listen to this Post
MessagePack-CSharp is a high-performance serializer that can be prone to denial of service attacks.
Specifically, when deserializing attacker-controlled data into System.Object, an issue arises.
The PrimitiveObjectFormatter class encounters an array during the deserialization workflow.
Before enforcing any maximum object-graph depth limit, it immediately allocates an array object.
It allocates this object[] using the declared array length directly from the payload header.
A specially crafted payload containing deeply nested arrays can exploit this exact behavior.
This allows attackers to keep many large arrays live simultaneously in memory.
Deserialization is only rejected after exceeding the maximum depth limit, but by then it is too late.
The array-header validation relies on the total unread byte count to confirm element presence.
Because of this logic, nested array headers can reuse the same trailing bytes repeatedly.
Therefore, a relatively small payload can trigger disproportionately large managed-heap allocations.
For instance, a 31.5 KiB payload can allocate roughly 114.7 MiB of reference storage on x64.
This creates an amplification factor of approximately 3,800 before a depth exception is raised.
Repeated requests of this nature cause severe memory pressure on the host application.
This results in excessive garbage collection cycles, process termination, and service disruption.
Applications handling untrusted data via object resolvers are primarily vulnerable.
ASP.NET Core SignalR applications using AddMessagePackProtocol represent a known remote vector.
Reachable hub methods with object parameters can directly pass malicious payloads.
The underlying flaw resides entirely within the MessagePack-CSharp deserialization implementation.
Attackers require no special authentication privileges for publicly reachable endpoints.
Protected endpoints still enforce their normal authorization checks before processing messages.
Mitigating this issue requires avoiding untrusted deserialization into System.Object entirely.
Developers should use concrete, narrowly defined Data Transfer Objects instead of object types.
Upgrading the package to patched versions resolves the allocate-before-depth-check behavior.
Ensuring robust input validation prevents excessive memory consumption from malicious payloads.
Monitoring memory usage helps detect potential denial-of-service attempts in production environments.
Proper configuration hardening safeguards applications against recursive heap exhaustion attacks.
DailyCVE Form:
Platform: MessagePack-CSharp
Version: Below 2.5.303
Vulnerability: Memory exhaustion
Severity: Medium severity
Date: October 2026
Prediction: Already patched
What Undercode Say:
Check package version dotnet list package --include-transitive | grep MessagePack Update vulnerable package dotnet add package MessagePack --version 2.5.307
Exploit: (Educational Purposes!)
// Conceptual payload structure for testing depth and array allocation var resolver = MessagePackSerializerOptions.Standard; byte[] maliciousPayload = CreateNestedArrayPayload(); MessagePackSerializer.Deserialize<object>(maliciousPayload, resolver);
Protection: from this CVE
Avoid deserializing untrusted data into System.Object. Use concrete DTO types, update MessagePack-CSharp to version 2.5.307 or later, and restrict hub method parameters in ASP.NET Core SignalR.
Impact:
Remote attackers can cause disproportionately large managed-heap allocations using small payloads, leading to severe memory pressure, excessive garbage collection, process termination, and denial of service availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
