---
id: CVE-2026-92707
title: MessagePack for C# is a MessagePack serializer for C#
summary: >-
  MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and
  3.1.9, deserializing attacker-controlled MessagePack data as System.Object
  through PrimitiveObjectFormatter can cause excessive memory allocation. The
  formatter …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-1325
vendor: MessagePack
product: MessagePack
affected:
  - MessagePack < 2.5.303
  - 'MessagePack >= 3.0.0, < 3.1.9'
patched:
  - MessagePack 2.5.303
  - MessagePack 3.1.9
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:48.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92707'
references:
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/7fd78bbf3476e03beae8b0f7a521125525a8a64a
    label: security-advisories@github.com
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/95b63fca4f7097d3cac12d1a95286af4b4bbf02c
    label: security-advisories@github.com
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.303
    label: security-advisories@github.com
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v3.1.9
    label: security-advisories@github.com
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhrr-8q5h-9q3h
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qhrr-8q5h-9q3h'
tags:
  - nvd
  - ghsa
  - nuget
  - cve.org
aliases:
  - GHSA-qhrr-8q5h-9q3h
ecosystem: nuget
ingestedAt: '2026-10-15T19:25:46.438Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T20:10:28.719217Z'
---

## Overview

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-92707)

Affected packages:

- `MessagePack < 2.5.303`
- `MessagePack >= 3.0.0, < 3.1.9`

Patched in:

- `MessagePack 2.5.303`
- `MessagePack 3.1.9`

Source: https://github.com/advisories/GHSA-qhrr-8q5h-9q3h