CVE-2026-92707

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in MessagePack for C#

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92707

EUVD

EUVD-2026-102315

Affected Vendors & Products

Vendor	Product	Version / Range
MessagePack-CSharp	MessagePack-CSharp	< 2.5.303
MessagePack-CSharp	MessagePack-CSharp	>= 3.0.0, < 3.1.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1325	The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

Executive Summary

This vulnerability in MessagePack for C# allows attackers to cause excessive memory allocation by sending specially crafted MessagePack data. When deserializing untrusted data into System.Object, the PrimitiveObjectFormatter allocates memory based on declared array lengths before checking depth limits. Nested arrays can reuse unread bytes to bypass validation, leading to large allocations from small payloads. This causes severe heap pressure, excessive garbage collection, process crashes, or service disruption.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or process crashes during MessagePack deserialization. Check for applications using vulnerable versions of MessagePack-CSharp (before 2.5.303 or 3.1.9) with untrusted input. Inspect logs for SignalR hub methods accepting object parameters with AddMessagePackProtocol enabled.

Impact Analysis

If your application uses MessagePack-CSharp and deserializes untrusted data as System.Object, an attacker could exploit this to crash your application, degrade performance through excessive garbage collection, or make your service unavailable. This is especially risky if your app exposes endpoints like ASP.NET Core SignalR hubs with object parameters and AddMessagePackProtocol enabled.

Compliance Impact

This vulnerability could lead to denial-of-service conditions due to excessive memory allocation, potentially causing service unavailability. For GDPR, this may impact availability of services processing personal data, violating Article 32 requirements for security. For HIPAA, it could disrupt systems handling protected health information, affecting integrity and availability under Security Rule standards.

Mitigation Strategies

Upgrade MessagePack-CSharp to version 2.5.303 or later if using v2.x, or to version 3.1.9 or later if using v3.x.
Avoid deserializing untrusted MessagePack data into System.Object; use concrete types instead.
Disable the MessagePack hub protocol in ASP.NET Core SignalR if not required.
Restrict SignalR hub methods to trusted callers or apply rate limiting to prevent repeated submissions.

Hi! I’m here to help you understand CVE-2026-92707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70