CVE-2026-48502— MessagePack-CSharp 配置错误漏洞

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.

N/A

跨界内存读

MessagePack-CSharp 配置错误漏洞

MessagePack-CSharp MessagePack-CSharp是MessagePack-CSharp团队的一款消息序列化工具。 MessagePack-CSharp 2.5.301之前版本和3.1.7之前版本存在安全漏洞，该漏洞源于在MessagePackReader.ReadDateTime()中，基于攻击者控制的MessagePack扩展长度分配堆栈内存，未经验证的扩展长度可导致栈分配触发不可捕获的堆栈溢出异常，从而终止主机进程。

N/A

N/A