CVE-2026-48511: MessagePack for C# DOS Vulnerability

CVE-2026-48511 Overview

CVE-2026-48511 affects MessagePack for C#, a widely used MessagePack serializer for the .NET ecosystem. The vulnerability resides in ExpandoObjectFormatter.Deserialize, which populates System.Dynamic.ExpandoObject instances by repeatedly calling IDictionary<string, object>.Add for each map entry. Attackers can supply large maps with many distinct keys to trigger quadratic CPU and allocation behavior during deserialization. The flaw is tracked as CWE-407, an algorithmic complexity issue. Versions prior to 2.5.301 and 3.1.7 are affected.

Critical Impact
Remote attackers can submit crafted MessagePack payloads containing large ExpandoObject maps to induce sustained CPU exhaustion and memory pressure, degrading availability of services that deserialize untrusted MessagePack data.

Affected Products

MessagePack-CSharp versions prior to 2.5.301
MessagePack-CSharp versions in the 3.x branch prior to 3.1.7
.NET applications using ExpandoObjectResolver to deserialize untrusted MessagePack input

Discovery Timeline

2026-06-22 - CVE-2026-48511 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48511

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in the deserialization path for dynamic objects. When ExpandoObjectFormatter.Deserialize reconstructs an ExpandoObject from a MessagePack map, it iterates over every entry and invokes IDictionary<string, object>.Add. Internally, ExpandoObject stores member names in array-like structures rather than a hashed dictionary. Each insertion of a new distinct key requires a linear scan to check for duplicates and an array copy to extend the storage.

For a map of size n, the cumulative work becomes proportional to n², producing quadratic CPU and allocation behavior. An attacker who controls a deserialization input can therefore amplify modest payload sizes into prolonged processing windows.

Root Cause

The root cause is a mismatch between the security model and the underlying data structure. ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, which substitutes collision-resistant comparers into dictionaries to prevent hash flooding. However, ExpandoObject does not use those comparers for its internal member storage. The protective configuration cannot reach the array-backed insertion logic inside ExpandoObject, leaving the deserializer exposed despite appearing hardened.

Attack Vector

Exploitation requires the target application to deserialize attacker-supplied MessagePack data into an ExpandoObject or a type that contains one. The attacker constructs a single map containing many distinct string keys and submits it over any channel that feeds the affected deserializer, such as an HTTP API endpoint, message broker payload, or RPC frame. No authentication or user interaction is required when the deserialization endpoint is reachable. The resulting CPU saturation reduces service throughput and can cascade into wider denial-of-service conditions on shared hosts.

No public proof-of-concept exploit code has been released. Refer to the GitHub Security Advisory GHSA-2x83-8g95-xh59 for upstream technical details.

Detection Methods for CVE-2026-48511

Indicators of Compromise

Sustained single-core CPU saturation in .NET processes hosting MessagePack deserialization endpoints
Large object heap growth and elevated Gen 2 garbage collection activity coinciding with inbound MessagePack traffic
Inbound MessagePack payloads containing maps with unusually high key counts targeting ExpandoObject types

Detection Strategies

Inventory .NET assemblies referencing MessagePack versions earlier than 2.5.301 or 3.1.7 using software composition analysis tooling
Identify code paths that call MessagePackSerializer.Deserialize with ExpandoObjectResolver or ContractlessStandardResolver on untrusted input
Profile application latency under fuzzed MessagePack inputs containing large maps to surface quadratic response curves

Monitoring Recommendations

Alert on prolonged CPU utilization in services that accept serialized data from external clients
Track request duration percentiles on endpoints that deserialize MessagePack, flagging outliers above baseline
Log payload sizes and map entry counts at the deserialization boundary to detect abusive submissions

How to Mitigate CVE-2026-48511

Immediate Actions Required

Upgrade MessagePack-CSharp to 2.5.301 or 3.1.7 or later across all .NET services and dependencies
Audit application code for any use of ExpandoObjectResolver or implicit ExpandoObject deserialization from external sources
Apply request size and entry-count limits at API gateways in front of services that deserialize MessagePack

Patch Information

The maintainers fixed the issue in MessagePack-CSharp 2.5.301 and 3.1.7. The patched releases address the quadratic insertion behavior in ExpandoObjectFormatter.Deserialize. Patch details are available in the GitHub Security Advisory GHSA-2x83-8g95-xh59.

Workarounds

Replace ExpandoObject deserialization targets with strongly typed models that constrain the expected schema
Reject MessagePack maps exceeding a conservative entry threshold before passing them to the deserializer
Run deserialization workloads under CPU and memory cgroup limits to contain resource exhaustion impact

bash

# Example: upgrade MessagePack-CSharp to a fixed version using the .NET CLI
dotnet add package MessagePack --version 3.1.7
# For projects pinned to the 2.5.x branch
dotnet add package MessagePack --version 2.5.301