ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-92707

MessagePack: Nested arrays can blow past buffer length limits

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · MessagePack: Nested arrays can

Check if you run it

No confirmed exploitation is on record for CVE-2026-92707. EPSS is 0.65%. Act only if a listed version of MessagePack: Nested arrays can is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (MessagePack: Nested arrays can).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.65%
Remediation
Version ranges on file
Affected products
NuGet MessagePack · nuget MessagePack · nuget messagepack

### Impact MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into . When encounters an array, it allocates an using the declared array length **before** enforcing the configured maximum object-graph depth. A specially crafted payload containing deeply nested arrays can therefore keep many large arrays live simultaneously before deserialization is rejected for exceeding the depth limit. Because the array-header validation uses the total unread byte count as evidence that the declared elements may be present, nested array headers can reuse the same trailing bytes for this validation. This permits a relatively small payload to cause disproportionately large managed-heap allocations. The reported example uses an approximately 31.5 KiB payload to allocate roughly 114.7 MiB of reference storage on x64—an amplification factor of approximately 3,800—before the depth exception is raised. Repeated requests may cause severe memory pressure, excessive garbage collection, process termination, or loss of service availability. Applications are affected when they: - Deserialize untrusted MessagePack data as , or otherwise use a resolver path that selects ; and - Permit an attacker to submit such data repeatedly. ASP.NET Core SignalR is one known way to expose the vulnerability remotely: an application that enables and has a reachable hub method with an parameter may pass attacker-controlled arguments to the vulnerable MessagePack-CSharp formatter. However, the underlying vulnerability is in MessagePack-CSharp, not SignalR, and other applications that deserialize untrusted data through the same formatter may also be affected. MessagePack-CSharp 2.5.302 is confirmed to contain the vulnerable code. Other releases containing the same allocate-before-depth-check behavior may also be affected. Authentication requirements depend on the application exposing the deserialization endpoint: exploitation require

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • NuGet MessagePack0 → 2.5.303
  • NuGet MessagePack3.0.0 → 3.1.9
  • nuget MessagePack< 2.5.303
  • nuget MessagePack>= 3.0.0, < 3.1.9
  • nuget messagepackversion unspecified

How to fix CVE-2026-92707

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-92707. EPSS is 0.65%. Act only if a listed version of MessagePack: Nested arrays can is installed.

Which versions are affected?

Compare what you have installed with MessagePack 0 → 2.5.303; MessagePack 3.0.0 → 3.1.9; MessagePack < 2.5.303; MessagePack >= 3.0.0, < 3.1.9. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1325. EPSS 0.65%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ### Impact MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into . When encounters an array, it allocates an using the declared array length **before** enforcing the configured maximum object-graph depth. A specially crafted payload containing deeply nested arrays can therefore keep many large arrays live simultan

  2. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Impact MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into . When encounters an array, it allocates an using the declared array length **before** enforcing the configured maximum object-graph depth. A specially crafted payload containing deeply nested arrays can therefore keep many large arrays live simultan

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    MessagePack fixed in 2.5.303; MessagePack fixed in 3.1.9

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    MessagePack fixed in 2.5.303

  5. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    MessagePack fixed in 3.1.9

  6. Oct 15, 2026 · NIST NVD

    Updated

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the sa

Sources

  • CVE.orgVulnerability recordCVE-2026-92707

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-92707

    30-day exploitation probability 0.6%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-qhrr-8q5h-9q3h

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-92707

    MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into System.Object. When PrimitiveObjectFormatter encounters an array, it allocates an object[] using the declared array length before enforcing the configured maximum object-graph depth. A specially crafted payload containing deeply nested arrays can therefore keep

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-92707

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared ar

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-qhrr-8q5h-9q3h

    MessagePack: Nested arrays can blow past buffer length limits

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.