CVE-2026-48509: MessagePack for C# insecure default in MessagePackInputFormatter

CVE-2026-48509 · Severity: medium · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library for ASP.NET Core could allow attackers to crash or slow down web applications. The library's default settings incorrectly treat data from the internet as 'trusted,' which can be exploited to cause high CPU usage or memory exhaustion. This affects services using MessagePack to process incoming web request bodies.

Technologies: MessagePack-CSharp MessagePack for C#, MessagePack-CSharp, MessagePack (NuGet). Vendors: MessagePack-CSharp, NuGet.

Quick answers

Is CVE-2026-48509 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48509 being exploited in the wild.
How severe is CVE-2026-48509?
Medium severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.
Is there a fix for CVE-2026-48509?
Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48509 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48509?
Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • MessagePack (NuGet): upgrade to 2.5.301 or later
    dotnet add package MessagePack --version 2.5.301

Technical details

The parameterless constructor for MessagePackInputFormatter in the MessagePack.AspNetCoreMvcFormatter package defaults to MessagePackSecurity.TrustedData. This posture is inappropriate for the HTTP trust boundary, as it does not mitigate algorithmic complexity attacks. An unauthenticated remote attacker can send crafted MessagePack request bodies containing colliding keys for hash-based collections (like Dictionaries), leading to a denial-of-service (DoS) condition. The vulnerability is addressed by changing the default to UntrustedData or requiring explicit security configuration.

Affected products

  • MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Identifiers

  • CVE-2026-48509
  • GHSA-2f33-pr97-265q

Timeline

  • 2026-06-09: disclosed
  • 2026-06-22: advisory: NVD publication
  • 2026-06-25: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.