CVE-2026-48509

Critical · CVSS 9.1

MessagePack for C# (MessagePack-CSharp) — Insecure default serializer options leading to denial-of-service via hash-collision attack (CWE-1188)

CVSS: 9.1; nvd
EPSS: 0.24%; 14th pct
KEV: No
Class: other; CWE-1188

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is fixed in 2.5.301 and 3.1.7.

Search profile — drives PoC discovery

Symbols MessagePackInputFormatterMessagePackSerializerOptions.StandardMessagePackSecurity.TrustedDataMessagePackSecurity.UntrustedDataMessagePackInputFormatter()MessagePackSerializerIInputFormatter

Keywords CVE-2026-48509GHSA-2f33-pr97-265qMessagePack-CSharp insecure defaultMessagePackInputFormatter PoCMessagePackSecurity TrustedData ASP.NET Corehash collision MessagePack denial of serviceMessagePack MVC formatter vulnerability

Versions: < 2.5.301, < 3.1.7

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2f33-pr97-265q

Status: enriched · ingested 2026-06-23T18:00:15.000Z · profiled 2026-06-24T06:30:26.000Z