Read the docs
TI-2026-74662 Aliases CVE-2026-92707GHSA-qhrr-8q5h-9q3h

Nested arrays in MessagePack for C# cause excessive memory allocation

Priority LOW 31CWE-1325Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

MessagePack for C# (MessagePack-CSharp) is affected before 2.5.303 and from 3.0.0 before 3.1.9. Deserializing untrusted data as System.Object through PrimitiveObjectFormatter allocates object arrays from declared lengths before the depth limit rejects the input (CWE-1325). A small payload can keep many large arrays alive, so an attacker who can submit such data repeatedly can exhaust managed heap memory, trigger excessive garbage collection, or terminate the process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00678 52nd percentileScored 2026-11-07
Fix Fixed MessagePack-CSharp (MessagePack-CSharp): 2.5.303, 3.1.9MessagePack (NuGet): 2.5.303, 3.1.9Red Hat: 14 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MessagePack-CSharpMessagePack-CSharpbefore 2.5.303; 3.0.0 to before 3.1.92.5.303, 3.1.9Patch availableCNA
—MessagePack (NuGet)before 2.5.3032.5.303Patch availableGHSA-qhrr-8q5h-9q3h
—MessagePack (NuGet)3.0.0 to before 3.1.93.1.9Patch availableGHSA-qhrr-8q5h-9q3h
  • MessagePack-CSharp VendorMessagePack-CSharp Affected before 2.5.303; 3.0.0 to before 3.1.9 Fixed in 2.5.303, 3.1.9 Patch available CNA
  • MessagePack (NuGet) Vendor— Affected before 2.5.303 Fixed in 2.5.303 Patch available GHSA-qhrr-8q5h-9q3h
  • MessagePack (NuGet) Vendor— Affected 3.0.0 to before 3.1.9 Fixed in 3.1.9 Patch available GHSA-qhrr-8q5h-9q3h

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:*:*:*——MessagePack-CSharp

Remediation

Update the NuGet MessagePack package to version 2.5.303 or 3.1.9. The sources list no fixed version for MessagePack-CSharp. Red Hat advisories RHSA-2026:89735, RHSA-2026:88474, RHSA-2026:88422, RHSA-2026:88425, RHSA-2026:88424, RHSA-2026:86594, RHSA-2026:86193, RHSA-2026:86171, RHSA-2026:86169, RHSA-2026:86192, RHSA-2026:86170, RHSA-2026:86172, RHSA-2026:86195 and RHSA-2026:86168 fix the .NET packages on Red Hat Enterprise Linux.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MessagePack-CSharp (MessagePack-CSharp) Fixed in 2.5.303, 3.1.9
  • Fix · GHSA-qhrr-8q5h-9q3h MessagePack (NuGet) Fixed in 2.5.303 Advisory →
  • Fix · GHSA-qhrr-8q5h-9q3h MessagePack (NuGet) Fixed in 3.1.9 Advisory →

Red Hat 14 advisories

  • RHSA-2026:89735 Released 2026-10-27 · Red Hat rating Critical
    .NET 9.0 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-9.0-9.0.21-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.21-1.el9_6 +12
  • RHSA-2026:88474 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.32-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_0 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_0
  • RHSA-2026:88422 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.32-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_6 +9
Show 11 more Red Hat advisories
  • RHSA-2026:88425 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) aspnetcore-runtime-8.0-8.0.32-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_4 +11
  • RHSA-2026:88424 Released 2026-10-22 · Red Hat rating Critical
    .NET 9.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-9.0-9.0.21-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.21-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_0
  • RHSA-2026:86594 Released 2026-10-21 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.32-2.el8_10, aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10, aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10 +9
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10
  • RHSA-2026:86193 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-10.0-10.0.13-1.el9_8, aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8, aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8
  • RHSA-2026:86171 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.21-1.el9_8, aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8, aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8
  • RHSA-2026:86169 Released 2026-10-20 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.32-1.el9_8, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_8, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8
  • RHSA-2026:86192 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-10.0-10.0.13-1.el8_10, aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10, aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10 +11
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10
  • RHSA-2026:86170 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.21-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10 +11
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10
  • RHSA-2026:86172 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.21-1.el10_2, aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2, aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2
  • RHSA-2026:86195 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-10.0-10.0.13-1.el10_2, aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2, aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2
  • RHSA-2026:86168 Released 2026-10-20 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.32-1.el10_2, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:88422, RHSA-2026:89735
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86168, RHSA-2026:86172, RHSA-2026:86195
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86170, RHSA-2026:86192, RHSA-2026:86594
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86169, RHSA-2026:86171, RHSA-2026:86193
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:88425
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:88424, RHSA-2026:88474
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:88422, RHSA-2026:89735
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:86170, RHSA-2026:86192, RHSA-2026:86594
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:86168, RHSA-2026:86172, RHSA-2026:86195
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:86169, RHSA-2026:86171, RHSA-2026:86193
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:88424, RHSA-2026:88474
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-92707
  2. 2026-10-16 Alias added: GHSA-qhrr-8q5h-9q3h
  3. 2026-10-18 EPSS moved to the 50th–90th percentile
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-20 CVSS score added · Red Hat
  6. 2026-10-21 Fix available: RHSA-2026:86168 · Red Hat
  7. 2026-10-21 Fix available: RHSA-2026:86169 · Red Hat
  8. 2026-10-21 Fix available: RHSA-2026:86170 · Red Hat
  9. 2026-10-21 Fix available: RHSA-2026:86171 · Red Hat
  10. 2026-10-21 Fix available: RHSA-2026:86192 · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:86193 · Red Hat
  12. 2026-10-21 Fix available: RHSA-2026:86172 · Red Hat
  13. 2026-10-21 Fix available: RHSA-2026:86195 · Red Hat
  14. 2026-10-21 Fix available: RHSA-2026:86594 · Red Hat
  15. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +3 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88422 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88424 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88474 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88425 · Red Hat
  20. 2026-10-23 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v. 10.0) +2 · Red Hat
  21. 2026-10-29 Fix available: RHSA-2026:89735 · Red Hat
  22. 2026-10-29 Affected versions changed · Red Hat

References

Other 6

  • TI-2024-32619 MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow CVSS 4.0HIGH 8.7
  • TI-2026-35549 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVSS 3.1HIGH 8.2
  • TI-2026-35866 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVSS 3.1HIGH 7.5
  • TI-2026-35873 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVSS 4.0MEDIUM 6.3
  • TI-2026-35863 Out-of-bounds read in MessagePack-CSharp CVSS 4.0HIGH 8.2
  • TI-2020-04290 Untrusted data can lead to DoS attack in MessagePack for C# and Unity CVSS 3.1MEDIUM 6.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences