CVE-2026-92707

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

This vulnerability is rated with Moderate severity for Red Hat products because exploitation is confined to an application denial of service and requires specific, non-default application configurations. In standard Red Hat Enterprise Linux deployments, .NET applications do not enable MessagePack serialization protocols by default. The issue only impacts environments where applications explicitly configure MessagePack handling—such as ASP.NET Core SignalR hubs utilizing MessagePack—and expose endpoints that deserialize untrusted input into generic object structures. Because arbitrary code execution and unauthorized data disclosure are not possible, the overall risk is reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.