Read the docs
TI-2026-35876 Aliases CVE-2026-48516GHSA-q2h6-ghwm-5qm8

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

Priority LOW 28CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.

Summary

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Fix Fixed MessagePack-CSharp (MessagePack-CSharp): 3.1.7, 2.5.301MessagePack (NuGet): 2.5.301, 3.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MessagePack-CSharpMessagePack-CSharp3.0 to before 3.1.7; before 2.5.3013.1.7, 2.5.301Patch availableCNA
—MessagePack (NuGet)before 2.5.3012.5.301Patch availableGHSA-q2h6-ghwm-5qm8
—MessagePack (NuGet)3.0 to before 3.1.73.1.7Patch availableGHSA-q2h6-ghwm-5qm8
  • MessagePack-CSharp VendorMessagePack-CSharp Affected 3.0 to before 3.1.7; before 2.5.301 Fixed in 3.1.7, 2.5.301 Patch available CNA
  • MessagePack (NuGet) Vendor— Affected before 2.5.301 Fixed in 2.5.301 Patch available GHSA-q2h6-ghwm-5qm8
  • MessagePack (NuGet) Vendor— Affected 3.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-q2h6-ghwm-5qm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:*before 2.5.301; 3.0.3 to before 3.1.7VulnerableMessagePack-CSharp
  • cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* Versions before 2.5.301; 3.0.3 to before 3.1.7 Vulnerable ·MessagePack-CSharp

Remediation

  • Fix · CNA MessagePack-CSharp (MessagePack-CSharp) Fixed in 3.1.7, 2.5.301
  • Fix · GHSA-q2h6-ghwm-5qm8 MessagePack (NuGet) Fixed in 2.5.301 Advisory →
  • Fix · GHSA-q2h6-ghwm-5qm8 MessagePack (NuGet) Fixed in 3.1.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48516
  2. 2026-10-03 Alias added: GHSA-q2h6-ghwm-5qm8

References

Advisory 2

Other 1

  • TI-2026-35549 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVSS 3.1HIGH 8.2
  • TI-2026-35866 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVSS 3.1HIGH 7.5
  • TI-2026-35873 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVSS 4.0MEDIUM 6.3
  • TI-2026-35863 Out-of-bounds read in MessagePack-CSharp CVSS 4.0HIGH 8.2
  • TI-2020-04290 Untrusted data can lead to DoS attack in MessagePack for C# and Unity CVSS 3.1MEDIUM 6.5
  • TI-2026-35877 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVSS 4.0MEDIUM 6.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences