CVE-2026-92707 MessagePack-CSharp CVE debrief

Who should care

Defenders responsible for applications using MessagePack for deserialization, especially in environments with untrusted input, should assess potential exposure and impact. This includes developers, security teams, and system administrators managing affected systems.

Why it matters

CVE-2026-92707 is a denial-of-service vulnerability in MessagePack-CSharp that can cause excessive memory allocation during deserialization of attacker-controlled data. Defenders should prioritize verifying exposure, especially in environments with untrusted input, and assess potential impact on service availability.

• Denial of service through excessive memory allocation
• Potential for severe memory pressure and process termination
• Excessive garbage collection impacting performance
• Loss of service availability due to memory exhaustion

Technical summary

MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into `System.Object`. When `PrimitiveObjectFormatter` encounters an array, it allocates an `object[]` using the declared array length **before** enforcing the configured maximum object-graph depth. A specially crafted payload containing deeply nested arrays can therefore keep many large arrays live simultaneously before deserialization is rejected for exceeding the depth limit. Because the array-header validation uses the total unread byte count as evidence that the declared elements may be present, nested array headers can reuse the same trailing bytes for this validation. This

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on applications using MessagePack for deserialization, especially in environments with untrusted input.

Recommended defensive actions

• Verify if applications using MessagePack are exposed to untrusted input
• Assess the potential impact of excessive memory allocation on service availability
• Update to fixed versions (2.5.303 or 3.1.9) where available
• Monitor for repeated requests that may cause severe memory pressure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on a denial-of-service vulnerability in MessagePack-CSharp, where deeply nested arrays can cause excessive memory allocation during deserialization. The CVE record and source item offer insights into the vulnerability's impact and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.