CVE-2026-48516 MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
Attackers can cause CPU denial of service in MessagePack-CSharp by exploiting hash collisions in interface lookups, bypassing security comparer settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48516?
CVE-2026-48516 is a medium-severity denial of service vulnerability in MessagePack-CSharp, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
Weakness: CWE-407
Which versions are affected by CVE-2026-48516?
4 open source packages ship an affected version, including MessagePack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MessagePack NuGet | All versions | 2.5.301 |
MessagePack NuGet | All versions | 2.5.301 |
MessagePack NuGet | From 3.0 | 3.1.7 |
MessagePack NuGet | From 3.0 | 3.1.7 |
Products include Messagepack Messagepack.
How do I fix CVE-2026-48516?
Upgrade MessagePack to a fixed version for your release line: 2.5.301 or 3.1.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48516 being exploited?
There is no known exploitation of CVE-2026-48516 in the wild and no public exploit code.
Other vulnerabilities in MessagePack-CSharp
- CVE-2026-48109 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
- CVE-2026-48502 MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- CVE-2026-48506 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
- CVE-2026-48509 MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
- CVE-2026-48510 MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Sources
Also known as ECHO-ac74-4323-cf63, GHSA-q2h6-ghwm-5qm8.