CVE-2026-48511: MessagePack for C# denial of service in ExpandoObjectFormatter

CVE-2026-48511 · Severity: high · CVSS 7.5 · Published 2026-06-22

MessagePack-CSharp is a library used to serialize and deserialize data for high-performance communication. A vulnerability in how it handles dynamic objects allows an attacker to send a specially crafted message that consumes excessive CPU and memory. This can lead to a denial-of-service (DoS) condition, making the affected server or application unresponsive to legitimate users.

Technologies: MessagePack-CSharp MessagePack for C#, MessagePack-CSharp, MessagePack (NuGet). Vendors: MessagePack-CSharp, NuGet.

Quick answers

Is CVE-2026-48511 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48511 being exploited in the wild.
How severe is CVE-2026-48511?
High severity, with a CVSS score of 7.5, published 22 June 2026.
Which products and versions are affected?
MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.
Is there a fix for CVE-2026-48511?
Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48511 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48511?
Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • MessagePack (NuGet): upgrade to 2.5.301 or later
    dotnet add package MessagePack --version 2.5.301

Technical details

The vulnerability is classified as CWE-407 (Inefficient Algorithmic Complexity). The ExpandoObjectFormatter.Deserialize method populates System.Dynamic.ExpandoObject by calling IDictionary.Add for each map entry. Because ExpandoObject internally uses array-like structures for member names, inserting many distinct keys results in repeated linear scans and array copies, leading to quadratic (O(n^2)) CPU and memory consumption. This occurs even when MessagePackSecurity.UntrustedData is enabled, as standard collision-resistant comparers do not mitigate ExpandoObject's internal insertion logic. Attackers can exploit this via the network without authentication by providing a large map with many distinct keys. Patches are available in versions 2.5.301 and 3.1.7.

Affected products

  • MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Identifiers

  • CVE-2026-48511
  • GHSA-2x83-8g95-xh59

Timeline

  • 2026-06-09: disclosed
  • 2026-06-22: advisory: NVD publication
  • 2026-06-25: patched: GitHub Advisory reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.