The vulnerability in MessagePack-CSharp involves the typeless deserialization safety check implemented by MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type). The check only inspects the outer type and does not recursively verify nested array element types or generic type arguments. Consequently, disallowed types can be embedded inside arrays or generic types and bypass the blocklist, allowing the formatter to instantiate these inner types. This weakens the intended mitigation against dangerous types during typeless deserialization. The vulnerability affects typeless deserialization features such as MessagePackSerializer.Typeless and TypelessObjectResolver. The issue is fixed in versions 2.5.301 and 3.1.7 by applying recursive type-disallow checks to nested types including arrays, pointers, nullable types, and generic arguments.

Applications using typeless deserialization with MessagePack-CSharp that rely on disallowed-type checks to block dangerous types may be vulnerable to bypasses. An attacker able to supply typeless ext-100 payloads can circumvent outer-type blocklists by wrapping disallowed types inside arrays or generic containers. This can lead to instantiation of blocked or user-blocklisted gadget types, potentially enabling unsafe deserialization behaviors. The severity is moderate given the requirement for typeless deserialization and attacker ability to supply crafted payloads.

A fix is available in MessagePack versions 2.5.301 and 3.1.7. Users should upgrade to these or later versions to ensure recursive type-disallow checks are enforced. Until patched, avoid using typeless deserialization on untrusted data. If typeless deserialization is necessary, configure an explicit allowlist that recursively validates array elements and generic arguments rather than relying on outer-type blocklists alone.