Skip to content
Fencer Intel
medium 5.3

CVE-2026-92707 json

MessagePack: Nested arrays can blow past buffer length limits

published 27d ago modified 26d ago also EUVD-2026-102315 , GHSA-qhrr-8q5h-9q3h

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Patch / fix

  • nuget MessagePack 2.5.303, 3.1.9
  • messagepack messagepack 2.5.303, 3.1.9
  • dotnet8 Ubuntu 22.04 LTS 8.0.132-8.0.32-0ubuntu1~22.04.1
  • dotnet8 Ubuntu 24.04 LTS 8.0.132-8.0.32-0ubuntu1~24.04.1
  • dotnet10 Ubuntu 24.04 LTS 10.0.113-10.0.13-0ubuntu1~24.04.1
  • dotnet10 Ubuntu 26.10 10.0.113-10.0.13-0ubuntu1~26.10.1
  • dotnet10 Ubuntu 26.04 LTS 10.0.113-10.0.13-0ubuntu1~26.04.1
  • dotnet11 Ubuntu 26.10 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1

ubuntu advisories UBUNTU-CVE-2026-92707

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dotnet-sdk-8.0 AlmaLinux 8 8.0.132-2.el8_10
  • dotnet-hostfxr-8.0 AlmaLinux 8 8.0.32-2.el8_10
  • dotnet-runtime-8.0 AlmaLinux 8 8.0.32-2.el8_10
  • dotnet-sdk-dbg-8.0 AlmaLinux 8 8.0.132-2.el8_10
  • dotnet-templates-8.0 AlmaLinux 8 8.0.132-2.el8_10
  • aspnetcore-runtime-8.0 AlmaLinux 8 8.0.32-2.el8_10
  • dotnet-runtime-dbg-8.0 AlmaLinux 8 8.0.32-2.el8_10
  • dotnet-apphost-pack-8.0 AlmaLinux 8 8.0.32-2.el8_10

almalinux advisories ALSA-2026:86594ALSA-2026:86168ALSA-2026:86169ALSA-2026:86170ALSA-2026:86171ALSA-2026:86172

  • dotnet8.0 Rocky Linux 10 8.0.132-1.el10_2
  • dotnet9.0 Rocky Linux 10 9.0.122-1.el10_2
  • dotnet10.0 Rocky Linux 10 10.0.113-1.el10_2
  • dotnet8.0 Rocky Linux 9 8.0.132-1.el9_8
  • dotnet9.0 Rocky Linux 9 9.0.122-1.el9_8
  • dotnet10.0 Rocky Linux 9 10.0.113-1.el9_8
  • dotnet9.0 Rocky Linux 8 9.0.122-1.el8_10
  • dotnet10.0 Rocky Linux 8 10.0.113-1.el8_10

rocky linux advisories RLSA-2026:86168RLSA-2026:86172RLSA-2026:86195RLSA-2026:86169RLSA-2026:86171RLSA-2026:86193

  • dotnet8-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 8.0.32-r0
  • dotnet9-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 9.0.21-r0
  • dotnet10-runtime Alpine 3.24, Alpine 3.23 10.0.13-r0

alpine advisories ALPINE-CVE-2026-92707

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-92707 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-92707 updated cvss 5.3

dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits

  • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts 8.0.132-1.el9_6, dotnet-sdk-9.0-source-built-artifacts 9.0.122-1.el9_6
    fixed: vendor fix RHSA-2026:88422
  • Red Hat Enterprise Linux AppStream (v. 8) dotnet 10.0.113-1.el8_10, dotnet8.0 8.0.132-2.el8_10, dotnet9.0 9.0.122-1.el8_10, dotnet10.0 10.0.113-1.el8_10, dotnet-sdk-8.0 8.0.132-2.el8_10, dotnet-sdk-9.0 9.0.122-1.el8_10, +34 more
    fixed: vendor fix RHSA-2026:86192
  • Red Hat Enterprise Linux AppStream (v. 9) dotnet8.0 8.0.132-1.el9_8, dotnet9.0 9.0.122-1.el9_8, dotnet-host 10.0.13-1.el9_8, dotnet10.0 10.0.113-1.el9_8, dotnet-sdk-8.0 8.0.132-1.el9_8, dotnet-sdk-9.0 9.0.122-1.el9_8, +34 more
    fixed: vendor fix RHSA-2026:86193
  • Red Hat Enterprise Linux AppStream (v. 10) dotnet8.0 8.0.132-1.el10_2, dotnet9.0 9.0.122-1.el10_2, dotnet-host 10.0.13-1.el10_2, dotnet10.0 10.0.113-1.el10_2, dotnet-sdk-8.0 8.0.132-1.el10_2, dotnet-sdk-9.0 9.0.122-1.el10_2, +34 more
    fixed: vendor fix RHSA-2026:86195
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) dotnet8.0 8.0.132-1.el9_4, dotnet-host 8.0.32-1.el9_4, dotnet-sdk-8.0 8.0.132-1.el9_4, dotnet-hostfxr-8.0 8.0.32-1.el9_4, dotnet-runtime-8.0 8.0.32-1.el9_4, dotnet-sdk-dbg-8.0 8.0.132-1.el9_4, +8 more
    fixed: vendor fix RHSA-2026:88425
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dotnet8.0 8.0.132-1.el10_0, dotnet9.0 9.0.122-1.el10_0, dotnet-host 9.0.21-1.el10_0, dotnet-sdk-8.0 8.0.132-1.el10_0, dotnet-sdk-9.0 9.0.122-1.el10_0, dotnet-hostfxr-8.0 8.0.32-1.el10_0, +21 more
    fixed: vendor fix RHSA-2026:88474
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) dotnet8.0 8.0.132-1.el9_6, dotnet9.0 9.0.122-1.el9_6, dotnet-host 9.0.21-1.el9_6, dotnet-sdk-8.0 8.0.132-1.el9_6, dotnet-sdk-9.0 9.0.122-1.el9_6, dotnet-hostfxr-8.0 8.0.32-1.el9_6, +21 more
    fixed: vendor fix RHSA-2026:88422
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts 8.0.132-1.el9_8, dotnet-sdk-9.0-source-built-artifacts 9.0.122-1.el9_8, dotnet-sdk-10.0-source-built-artifacts 10.0.113-1.el9_8
    fixed: vendor fix RHSA-2026:86193
show 4 more
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts 8.0.132-1.el10_2, dotnet-sdk-9.0-source-built-artifacts 9.0.122-1.el10_2, dotnet-sdk-10.0-source-built-artifacts 10.0.113-1.el10_2
    fixed: vendor fix RHSA-2026:86195
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts 8.0.132-1.el10_0, dotnet-sdk-9.0-source-built-artifacts 9.0.122-1.el10_0
    fixed: vendor fix RHSA-2026:88474
  • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts 8.0.132-2.el8_10, dotnet-sdk-9.0-source-built-artifacts 9.0.122-1.el8_10, dotnet-sdk-10.0-source-built-artifacts 10.0.113-1.el8_10
    fixed: vendor fix RHSA-2026:86192
  • Red Hat Hardened Images dotnet10.0 10.0.112-1.hum1, dotnet8.0 8.0.131-0.1.hum1, dotnet9.0 9.0.121-0.1.hum1
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
27d ago

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
nuget MessagePack
<2.5.303
>=3.0.0, <3.1.9
2.5.303
3.1.9

Affected products

  • MessagePack-CSharp MessagePack-CSharp

Classification

Weakness
  • CWE-1325 Improperly Controlled Sequential Memory Allocation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.