Listen to this Post
How CVE-2026-48510 Works
The MessagePack-CSharp library includes optional LZ4 compression modes—Lz4Block and Lz4BlockArray—to reduce payload size during serialization. When deserializing data with either of these modes enabled, the library reads a declared uncompressed length from the incoming wire data and allocates an output buffer of that size before performing any validation on the compressed payload.
An attacker can craft a malicious MessagePack payload that is physically small (a few bytes) but declares an enormous uncompressed length—for example, claiming that a 1 KB compressed block will expand to 1 GB. The library trusts this attacker-controlled integer and attempts to allocate a buffer of the claimed size. Only after this allocation does it begin the LZ4 decompression process, at which point it may discover that the compressed data is invalid or that the expansion is unreasonable.
In the `Lz4BlockArray` mode, the attack surface is even larger: each block within the array declares its own uncompressed length, and the library sums these values to determine the total output size. An attacker can control both the per-block lengths and their aggregate, potentially forcing an allocation that is orders of magnitude larger than the input.
This unbounded allocation leads to memory exhaustion. On systems without hard memory limits, the process may consume all available RAM, triggering an `OutOfMemoryException` and crashing the application. On constrained hosts (such as containers with memory limits), the process is terminated by the operating system’s OOM killer. Even if the allocation succeeds, the resulting memory pressure can severely degrade performance for other services running on the same host.
The vulnerability is classified under CWE-409 (Improper Handling of Highly Compressed Data) and CWE-770 (Allocation of Resources Without Limits or Throttling). It is distinct from a separate LZ4 source-buffer over-read issue (CVE-2026-48109), which concerns unsafe reads beyond the compressed input buffer. The fix involves rejecting negative and excessive uncompressed lengths before allocation, capping aggregate decompressed sizes for block arrays, and honoring a configurable maximum decompressed length policy.
DailyCVE Form
Platform: MessagePack-CSharp
Version: <2.5.301, <3.1.7
Vulnerability: Unbounded memory allocation
Severity: Medium (CVSS 6.3)
date: 2026-06-22
Prediction: Patch released 2026-06-22
What Undercode Say
Check installed MessagePack version in a .NET project dotnet list package --outdated | grep MessagePack Verify version in csproj file grep -i "MessagePack" .csproj Monitor memory allocation during deserialization (Linux) watch -n 1 'ps aux | grep -E "dotnet|MessagePack" | grep -v grep' Test for vulnerability with a crafted payload (conceptual) echo -n "\x92\xc0\xc0" | xxd Minimal MessagePack with LZ4 header
// Vulnerable code path (simplified) int uncompressedLength = reader.ReadInt32(); // Attacker-controlled byte[] outputBuffer = new byte[bash]; // Unbounded allocation LZ4Decoder.Decode(compressedData, outputBuffer);
// Patched approach (conceptual)
int uncompressedLength = reader.ReadInt32();
if (uncompressedLength < 0 || uncompressedLength > MaxDecompressedSize)
throw new InvalidOperationException("Excessive uncompressed length");
byte[] outputBuffer = new byte[bash];
LZ4Decoder.Decode(compressedData, outputBuffer);
Exploit
An attacker can exploit this vulnerability by sending a malicious MessagePack payload with LZ4 compression enabled. The payload contains a small compressed body (e.g., a few dozen bytes) but declares an `uncompressed_length` field set to a very large value—such as `int.MaxValue` (2,147,483,647 bytes) or larger in block array modes where multiple blocks are aggregated. The target application, using an affected version of MessagePack-CSharp with `Lz4Block` or `Lz4BlockArray` compression enabled, reads this length and attempts to allocate memory accordingly. This causes memory exhaustion, leading to process termination or denial of service.
The attacker requires no special privileges; the application using the library is the only necessary context. The attack can be delivered over any network protocol or file format that accepts MessagePack input, making it broadly applicable to web services, APIs, and data processing pipelines.
Protection
- Upgrade immediately: Update MessagePack-CSharp to version 2.5.301 (for the 2.x line) or 3.1.7 (for the 3.x line) or newer. These patched versions reject excessive uncompressed lengths before allocation and enforce configurable maximum decompressed size limits.
- Disable LZ4 compression for untrusted inputs: If an immediate upgrade is not possible, disable the built-in LZ4 compression modes (
Lz4BlockandLz4BlockArray) when deserializing data from untrusted sources. - Implement external size limits: If compression is required, enforce strict compressed and decompressed size limits outside MessagePack-CSharp before passing data to the deserializer.
- Apply defensive checks: As a temporary workaround, validate the claimed uncompressed length against a reasonable maximum (e.g., 10 MB) and reject the payload if the limit is exceeded.
Impact
- Denial of Service: Successful exploitation causes memory exhaustion, resulting in process crashes, OOM kills, or severe performance degradation.
- Service Unavailability: On shared or constrained hosts, the crash can render the entire service unavailable until restarted.
- No Data Breach: This vulnerability does not expose sensitive data; it is strictly a resource exhaustion issue.
- Wide Applicability: Any application using affected MessagePack-CSharp versions with LZ4 compression enabled is vulnerable.
- Ease of Exploitation: The attack requires only a small malicious payload and no special privileges.
- CVSS Score: 6.3 (Medium) with vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
