Read the docs
TI-2026-35871 Aliases CVE-2026-48511GHSA-2x83-8g95-xh59

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

Priority LOW 28CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.

Summary

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Fix Fixed MessagePack-CSharp (MessagePack-CSharp): 3.1.7, 2.5.301MessagePack (NuGet): 2.5.301, 3.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MessagePack-CSharpMessagePack-CSharp3.0 to before 3.1.7; before 2.5.3013.1.7, 2.5.301Patch availableCNA
—MessagePack (NuGet)before 2.5.3012.5.301Patch availableGHSA-2x83-8g95-xh59
—MessagePack (NuGet)3.0 to before 3.1.73.1.7Patch availableGHSA-2x83-8g95-xh59
  • MessagePack-CSharp VendorMessagePack-CSharp Affected 3.0 to before 3.1.7; before 2.5.301 Fixed in 3.1.7, 2.5.301 Patch available CNA
  • MessagePack (NuGet) Vendor— Affected before 2.5.301 Fixed in 2.5.301 Patch available GHSA-2x83-8g95-xh59
  • MessagePack (NuGet) Vendor— Affected 3.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-2x83-8g95-xh59

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:*before 2.5.301; 3.0.3 to before 3.1.7VulnerableMessagePack-CSharp
  • cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* Versions before 2.5.301; 3.0.3 to before 3.1.7 Vulnerable ·MessagePack-CSharp

Remediation

  • Fix · CNA MessagePack-CSharp (MessagePack-CSharp) Fixed in 3.1.7, 2.5.301
  • Fix · GHSA-2x83-8g95-xh59 MessagePack (NuGet) Fixed in 2.5.301 Advisory →
  • Fix · GHSA-2x83-8g95-xh59 MessagePack (NuGet) Fixed in 3.1.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48511
  2. 2026-10-03 Alias added: GHSA-2x83-8g95-xh59

References

Advisory 2

Other 1

  • TI-2026-35549 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVSS 3.1HIGH 8.2
  • TI-2026-35866 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVSS 3.1HIGH 7.5
  • TI-2026-35873 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVSS 4.0MEDIUM 6.3
  • TI-2026-35863 Out-of-bounds read in MessagePack-CSharp CVSS 4.0HIGH 8.2
  • TI-2020-04290 Untrusted data can lead to DoS attack in MessagePack for C# and Unity CVSS 3.1MEDIUM 6.5
  • TI-2026-35877 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVSS 4.0MEDIUM 6.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences