CVE-2026-92707

MessagePack for C# before 2.5.303 and 3.1.9 can be driven into excessive memory use when PrimitiveObjectFormatter deserializes attacker-controlled MessagePack as System.Object. The formatter allocates an object array from each declared array length before the object-graph depth limit rejects the input, and nested array headers can reuse the same unread trailing bytes so a small payload keeps many large arrays alive at once. Repeated submissions can exhaust the managed heap, force heavy garbage collection, terminate the process, or deny service; there is no confidentiality or integrity impact. Only applications that deserialize untrusted MessagePack on this path are affected, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. There is no known public proof of concept and the issue is not listed in CISA KEV; fixes are in 2.5.303 and 3.1.9.

What to do: Upgrade MessagePack for C# to 2.5.303 or 3.1.9 (or later on that line). Until then, do not deserialize untrusted MessagePack as System.Object through PrimitiveObjectFormatter; review ASP.NET Core SignalR hubs that use AddMessagePackProtocol() with object parameters, and limit message size and request rate on any endpoint that accepts attacker-controlled MessagePack.