{"items":[{"id":"NVI-00017491","kind":"vulnerability","title":"MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wfr3-xj75-pfwh","CVE-2026-48513"],"plain_summary":"GitHub lists this reviewed advisory for MessagePack, MessagePack. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0a45b018d957208c1387e4d0717b39e1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0a45b018d957208c1387e4d0717b39e1","url":"https://github.com/advisories/GHSA-wfr3-xj75-pfwh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wfr3-xj75-pfwh","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:53.922Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0a45b018d957208c1387e4d0717b39e1"],"technology":"MessagePack","known_exclusions":[],"conditions_summary":"## Summary\n\nRuntime-generated union deserializers emitted by `DynamicUnionResolver` do not call `MessagePackSecurity.DepthStep(ref reader)` and do not decrement `reader.Depth` around recursive deserialization and skip paths.\n\nThis means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls `reader.Skip()` on attacker-controlled data without an enclosing depth step.\n\n## Impact\n\nApplications are affected when they deserialize untrusted payloads into object graphs containing `[Union]`-decorated interfaces or abstract classes handled by `DynamicUnionResolver`.\n\nAn attacker can provide a union payload with an unknown key and a deeply nested value. Because the generated union formatter does not enter the depth accounting scope before skipping or recursively processing the value, configured depth limits can be bypassed. In combination with recursive skip behavior, this can terminate the process with an uncatchable `StackOverflowException`.\n\nThis issue is narrower than the general `TrySkip()` recursion issue because it specifically concerns a","public_affected_ranges":["< 2.5.301"]},{"certainty":"source_listed","source_ids":["sr-0a45b018d957208c1387e4d0717b39e1"],"technology":"MessagePack","known_exclusions":[],"conditions_summary":"## Summary\n\nRuntime-generated union deserializers emitted by `DynamicUnionResolver` do not call `MessagePackSecurity.DepthStep(ref reader)` and do not decrement `reader.Depth` around recursive deserialization and skip paths.\n\nThis means union deserialization does not consistently participate in the maximum object graph depth enforcement that protects other recursive formatter paths. For unknown union keys, the emitted deserializer calls `reader.Skip()` on attacker-controlled data without an enclosing depth step.\n\n## Impact\n\nApplications are affected when they deserialize untrusted payloads into object graphs containing `[Union]`-decorated interfaces or abstract classes handled by `DynamicUnionResolver`.\n\nAn attacker can provide a union payload with an unknown key and a deeply nested value. Because the generated union formatter does not enter the depth accounting scope before skipping or recursively processing the value, configured depth limits can be bypassed. In combination with recursive skip behavior, this can terminate the process with an uncatchable `StackOverflowException`.\n\nThis issue is narrower than the general `TrySkip()` recursion issue because it specifically concerns a","public_affected_ranges":[">= 3.0, < 3.1.7"]}],"null_published_at":"2026-11-05T19:10:21.397Z","source_updated_at":"2026-06-25T21:22:53.000Z","source_disclosed_at":"2026-06-25T21:22:52.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:53.922Z"}],"next_cursor":null,"snapshot_revision":"42594"}