CVE-2026-48516: MessagePack for C# DOS Vulnerability

CVE-2026-48516 Overview

CVE-2026-48516 affects MessagePack for C#, a serialization library used by .NET applications to encode and decode data in the MessagePack format. The vulnerability resides in the InterfaceLookupFormatter<TKey,TElement> class. This formatter constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> using the default equality comparer instead of the security-aware comparer from options.Security.GetEqualityComparer<TKey>(). Attackers who supply crafted keys can trigger hash collisions and cause CPU-bound denial of service. The flaw bypasses the untrusted-data security posture that applications explicitly opt into. Versions prior to 2.5.301 and 3.1.7 are affected.

Critical Impact
Remote attackers can submit crafted MessagePack payloads targeting ILookup<TKey,TElement> deserialization to exhaust CPU resources, degrading service availability even when applications enable hardened security options.

Affected Products

MessagePack for C# versions prior to 2.5.301
MessagePack for C# versions prior to 3.1.7
.NET applications deserializing untrusted ILookup<TKey,TElement> data via MessagePack-CSharp

Discovery Timeline

2026-06-22 - CVE-2026-48516 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48516

Vulnerability Analysis

The vulnerability is classified under [CWE-407] Inefficient Algorithmic Complexity. MessagePack for C# provides a security configuration that wraps key comparers with collision-resistant implementations. Applications opt in by setting options.Security to the untrusted-data posture. The library then expects all internal hash-based collections to use options.Security.GetEqualityComparer<TKey>() when storing attacker-controlled keys.

InterfaceLookupFormatter<TKey,TElement> violates this contract. It instantiates its backing dictionary with the default equality comparer, exposing the lookup deserialization path to algorithmic complexity attacks. An attacker who crafts many keys that hash to the same bucket forces the dictionary into O(n²) insertion behavior. Each malicious payload then consumes disproportionate CPU time on the target host.

Root Cause

The root cause is an inconsistent application of the security-aware equality comparer inside InterfaceLookupFormatter<TKey,TElement>. The formatter ignores the comparer supplied by options.Security and falls back to the framework default. This omission leaves one deserialization path unprotected while sibling formatters honor the hardened comparer.

Attack Vector

Exploitation requires network reachability to an endpoint that deserializes attacker-supplied MessagePack data into an ILookup<TKey,TElement> type. The attacker constructs a payload containing keys engineered to collide under the default hash function. When the formatter populates its internal dictionary, key insertion degrades to linear scans, pinning a CPU core for the duration of the deserialization call.

No authentication is required when the deserialization endpoint is publicly exposed. The vulnerability does not yield code execution, data disclosure, or integrity loss. Successful attacks reduce availability through resource exhaustion.

Detection Methods for CVE-2026-48516

Indicators of Compromise

Sustained CPU saturation on application worker threads correlated with inbound MessagePack traffic
Elevated latency or timeouts on endpoints that deserialize ILookup<TKey,TElement> structures
Anomalously large or repetitive key sets in MessagePack payloads received from a single source

Detection Strategies

Inventory .NET applications and confirm the version of the MessagePack NuGet package in use
Inspect application code for deserialization targets typed as ILookup<,> or transitively containing one
Correlate request rate, payload size, and CPU time per request to surface algorithmic complexity attacks

Monitoring Recommendations

Track per-endpoint p95 and p99 latency for services accepting MessagePack input
Alert on requests whose CPU consumption exceeds normal baselines by an order of magnitude
Log MessagePack deserialization exceptions and timeouts for forensic review

How to Mitigate CVE-2026-48516

Immediate Actions Required

Upgrade MessagePack for C# to version 2.5.301 or 3.1.7, depending on the major version branch in use
Audit deserialization entry points that accept untrusted input and validate that MessagePackSerializerOptions.Security.UntrustedData is applied
Apply request-level CPU and timeout limits on services exposing MessagePack endpoints to the network

Patch Information

The maintainers fixed the issue by routing InterfaceLookupFormatter<TKey,TElement> through the security-aware equality comparer. The fix ships in MessagePack-CSharp 2.5.301 and 3.1.7. Refer to the GitHub Security Advisory GHSA-q2h6-ghwm-5qm8 for the upstream details.

Workarounds

Avoid deserializing untrusted input into ILookup<TKey,TElement> types until the patched library is deployed
Place rate limits and request size caps in front of MessagePack endpoints to constrain attacker amplification
Run deserialization in bounded worker pools with hard CPU time budgets to contain resource exhaustion

bash

# Update the MessagePack NuGet package to a fixed release
dotnet add package MessagePack --version 3.1.7
# Or, for the 2.5.x branch
dotnet add package MessagePack --version 2.5.301