CVE-2026-48509: MessagePack for C# DOS Vulnerability

CVE-2026-48509 Overview

CVE-2026-48509 affects MessagePack for C#, a widely used MessagePack serializer library for .NET applications. The vulnerability stems from an insecure default configuration in the parameterless MessagePackInputFormatter() constructor. This constructor applies MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData, even though the formatter handles ASP.NET Core MVC request bodies that cross an HTTP trust boundary. Attackers can leverage this misconfiguration to trigger denial-of-service conditions through hash-collision attacks against dictionary-like model properties. The issue is fixed in versions 2.5.301 and 3.1.7.

Critical Impact
Remote attackers can send crafted MessagePack payloads to ASP.NET Core endpoints, exhausting CPU resources through hash-collision attacks and causing denial of service.

Affected Products

MessagePack for C# versions prior to 2.5.301
MessagePack for C# versions prior to 3.1.7
ASP.NET Core applications using MessagePackInputFormatter with default constructor

Discovery Timeline

2026-06-22 - CVE CVE-2026-48509 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48509

Vulnerability Analysis

The vulnerability is classified under [CWE-1188] (Initialization of a Resource with an Insecure Default). MessagePack for C# provides two security modes through MessagePackSecurity: TrustedData for internal use cases and UntrustedData for inputs crossing trust boundaries. The UntrustedData mode applies protections including randomized hashing to defeat hash-collision attacks against dictionary keys.

The MessagePackInputFormatter integrates into ASP.NET Core MVC's request pipeline to deserialize HTTP request bodies. Request bodies inherently cross an HTTP trust boundary, meaning the data should be treated as untrusted. However, the parameterless constructor silently selected TrustedData options, disabling the hash-collision mitigations that ASP.NET Core endpoints require.

Root Cause

The root cause is an insecure default value chosen for a resource handling network-exposed inputs. The parameterless MessagePackInputFormatter() constructor resolved to MessagePackSerializerOptions.Standard, which carries the MessagePackSecurity.TrustedData security setting. Developers using the default constructor inherited this insecure baseline without explicit opt-in.

Attack Vector

An unauthenticated remote attacker can submit MessagePack-encoded HTTP request bodies containing dictionary structures with keys crafted to collide in the underlying hash table. Without randomized hashing, the receiving application performs degenerate O(n²) work to insert keys, consuming CPU and degrading service availability. Repeated requests amplify the impact and can render the application unresponsive. The attack requires no authentication, no user interaction, and is delivered over the network to any endpoint accepting MessagePack input.

The vulnerability manifests when application code instantiates the formatter using the default constructor rather than supplying options configured with MessagePackSecurity.UntrustedData. See the GitHub Security Advisory GHSA-2f33-pr97-265q for technical details.

Detection Methods for CVE-2026-48509

Indicators of Compromise

Sustained CPU saturation on ASP.NET Core worker processes correlated with inbound MessagePack-content-type requests
Elevated request processing latency on endpoints registered with MessagePackInputFormatter
HTTP request bodies with Content-Type: application/x-msgpack containing unusually large or deeply nested map structures
Repeated requests from a single source targeting MessagePack-enabled controllers

Detection Strategies

Inventory .NET projects for references to MessagePack package versions earlier than 2.5.301 (2.x branch) or 3.1.7 (3.x branch)
Audit source code for calls to new MessagePackInputFormatter() without explicit MessagePackSerializerOptions arguments
Inspect ASP.NET Core startup configuration for AddMvc or AddControllers pipelines registering MessagePack formatters
Monitor request-duration and CPU-time metrics for outliers on endpoints accepting MessagePack content

Monitoring Recommendations

Instrument application telemetry to alert on sustained CPU spikes tied to specific request paths or client IPs
Log MessagePack request body sizes and key counts to identify anomalous payloads
Enable rate limiting and request-size limits on endpoints accepting serialized binary content

How to Mitigate CVE-2026-48509

Immediate Actions Required

Upgrade the MessagePack NuGet package to version 2.5.301 or 3.1.7 immediately
Audit application code for usage of the parameterless MessagePackInputFormatter() constructor and replace with an instance configured for MessagePackSecurity.UntrustedData
Apply request-size and rate-limiting controls on endpoints that deserialize MessagePack input
Restart affected ASP.NET Core services after applying the patched package

Patch Information

The MessagePack for C# maintainers released fixed versions 2.5.301 and 3.1.7. The patched releases adjust the formatter so that inputs crossing the HTTP trust boundary are processed with MessagePackSecurity.UntrustedData semantics. See the GitHub Security Advisory GHSA-2f33-pr97-265q for release notes and upgrade guidance.

Workarounds

Explicitly construct MessagePackInputFormatter with options derived from MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData) until the package can be upgraded
Place a reverse proxy or web application firewall in front of affected services to enforce request-size limits and throttle suspicious clients
Disable MessagePack input formatting on endpoints that do not require it

bash

# Configuration example: upgrade the MessagePack package
dotnet add package MessagePack --version 3.1.7
# or for the 2.x branch
dotnet add package MessagePack --version 2.5.301