# CVE-2026-48509: MessagePack for C# insecure default in MessagePackInputFormatter

Source: https://junglewise.ai/threats/cve-2026-48509-messagepack-for-c-insecure-default-in-messagepackinputformatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48509 · Severity: medium · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library for ASP.NET Core could allow attackers to crash or slow down web applications. The library's default settings incorrectly treat data from the internet as 'trusted,' which can be exploited to cause high CPU usage or memory exhaustion. This affects services using MessagePack to process incoming web request bodies.

Technologies: [MessagePack-CSharp MessagePack for C#](https://junglewise.ai/threats/technologies/messagepack-for-c), [MessagePack-CSharp](https://junglewise.ai/threats/technologies/messagepack-csharp), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48509 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48509 being exploited in the wild.

**How severe is CVE-2026-48509?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.

**Is there a fix for CVE-2026-48509?** Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48509 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48509?** Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 2.5.301 or later

  ```sh
  dotnet add package MessagePack --version 2.5.301
  ```


## Technical details

The parameterless constructor for MessagePackInputFormatter in the MessagePack.AspNetCoreMvcFormatter package defaults to MessagePackSecurity.TrustedData. This posture is inappropriate for the HTTP trust boundary, as it does not mitigate algorithmic complexity attacks. An unauthenticated remote attacker can send crafted MessagePack request bodies containing colliding keys for hash-based collections (like Dictionaries), leading to a denial-of-service (DoS) condition. The vulnerability is addressed by changing the default to UntrustedData or requiring explicit security configuration.

## Affected products

- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48509
- GHSA-2f33-pr97-265q

## Timeline

- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication
- 2026-06-25: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# hash-collision DoS in InterfaceLookupFormatter](https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)