MessagePack-CSharp CVE-2026-92707 memory amplification DoS (small payload allocates huge memory): which MessagePack / SignalR versions fix it?

Am I affected: you are if a .NET service deserializes untrusted MessagePack data into System.Object (or dynamic/untyped collections) through PrimitiveObjectFormatter with MessagePack-CSharp before 2.5.303, or 3.x before 3.1.9. A small crafted payload with nested arrays can force very large allocations. Repeated requests can cause heavy GC pressure, out-of-memory crashes and loss of service. ASP.NET Core SignalR with the MessagePack hub protocol (Microsoft.AspNetCore.SignalR.Protocols.MessagePack 6.0.0 through 6.0.46) is also listed as affected. Microsoft's October 2026 Patch Tuesday listed this flaw as publicly disclosed. It is a denial-of-service bug, not code execution. How to check: run 'dotnet list package --include-transitive' and look for MessagePack and Microsoft.AspNetCore.SignalR.Protocols.MessagePack. Then check whether any endpoint deserializes client-supplied data as object/untyped rather than into concrete types. Fix: - MessagePack: upgrade to 2.5.303 (2.x line) or 3.1.9 or later (3.x line). - SignalR MessagePack protocol on .NET 6: move to a fixed package or runtime servicing release per Microsoft's advisory, or move to a supported .NET version, since .NET 6 is out of support. Interim mitigation: deserialize into concrete types instead of object, use MessagePackSecurity.UntrustedData options, cap request and message sizes (for example SignalR's MaximumReceiveMessageSize), and rate-limit clients. After patching: rebuild and redeploy every service that ships the package, including transitive copies, and watch memory and GC metrics for spikes on endpoints that accept MessagePack. Sources: https://security-tracker.debian.org/tracker/CVE-2026-92707 https://bugzilla.redhat.com/show_bug.cgi?id=2548800 https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/