CVE-2026-48509 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is fixed in 2.5.301 and 3.1.7.
A denial-of-service vulnerability has been identified in MessagePack for C# versions prior to 2.5.301 and 3.1.7. The issue arises because the parameterless MessagePackInputFormatter constructor defaults to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. This default setting is problematic for ASP.NET Core MVC request bodies, which often cross an HTTP trust boundary. The insecure default can lead to denial-of-service attacks, such as hash-collision attacks against dictionary-like model properties, exploiting the trusted-data posture that should be reserved for untrusted sources.
To address this vulnerability, users should upgrade to MessagePack for C# versions 2.5.301 or 3.1.7. If using the MessagePackInputFormatter, avoid the parameterless constructor on affected versions. Instead, register the formatter with explicit untrusted-data options, applying normal HTTP request-size limits and model validation appropriate for the service.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2f33-pr97-265q | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |