CVE-2026-48509: MessagePack for C# insecure default in MessagePackInputFormatter

Executive brief

A vulnerability in the MessagePack-CSharp library for ASP.NET Core could allow attackers to crash or slow down web applications. The library's default settings incorrectly treat data from the internet as 'trusted,' which can be exploited to cause high CPU usage or memory exhaustion. This affects services using MessagePack to process incoming web request bodies.

Technical details

The parameterless constructor for MessagePackInputFormatter in the MessagePack.AspNetCoreMvcFormatter package defaults to MessagePackSecurity.TrustedData. This posture is inappropriate for the HTTP trust boundary, as it does not mitigate algorithmic complexity attacks. An unauthenticated remote attacker can send crafted MessagePack request bodies containing colliding keys for hash-based collections (like Dictionaries), leading to a denial-of-service (DoS) condition. The vulnerability is addressed by changing the default to UntrustedData or requiring explicit security configuration.

Affected products

• MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Timeline

• 2026-06-09: disclosed
• 2026-06-22: advisory: NVD publication
• 2026-06-25: patched: GitHub Advisory reviewed and updated

References

• https://api.github.com/users/AArnott
• https://github.com/AArnott
• https://api.github.com/users/AArnott/gists%7B/gist_id%7D
• https://api.github.com/users/AArnott/repos
• https://avatars.githubusercontent.com/u/3548?v=4
• https://api.github.com/users/AArnott/events%7B/privacy%7D