CVE-2026-48516 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
A denial-of-service vulnerability has been identified in the MessagePack for C# library, specifically in versions prior to 2.5.301 and 3.1.7. The issue arises in the InterfaceLookupFormatter<TKey,TElement>, which creates an internal Dictionary<TKey, IGrouping<TKey,TElement>> using the default equality comparer. This approach neglects the security-aware comparer provided by options.Security.GetEqualityComparer<TKey>(). As a result, applications that deserialize untrusted data into ILookup<TKey,TElement> schemas vulnerable to hash-collision attacks can experience CPU exhaustion, bypassing intended security mitigations.
Users are advised to upgrade MessagePack to version 2.5.301 or 3.1.7. Additionally, upgrade any companion MessagePack packages in the same dependency graph to the coordinated patched versions. Until a patch is applied, avoid using ILookup<TKey,TElement> with untrusted data, or validate and limit collection sizes at the transport boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-q2h6-ghwm-5qm8 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |