# CVE-2026-48516: MessagePack for C# hash-collision DoS in InterfaceLookupFormatter

Source: https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48516 · Severity: medium · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library could allow an attacker to cause a denial-of-service (DoS) condition by overwhelming a system's CPU. This occurs when the library processes specially crafted data that bypasses security settings intended to prevent hash-collision attacks. If exploited, this could lead to significant application slowdowns or service outages, impacting business operations and availability.

Technologies: [MessagePack-CSharp MessagePack for C#](https://junglewise.ai/threats/technologies/messagepack-for-c), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48516 being exploited in the wild.

**How severe is CVE-2026-48516?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0 < 3.1.7, < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.

**Is there a fix for CVE-2026-48516?** Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48516 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48516?** Check whether you run MessagePack-CSharp MessagePack for C# or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 2.5.301 or later

  ```sh
  dotnet add package MessagePack --version 2.5.301
  ```


## Technical details

The InterfaceLookupFormatter<TKey, TElement> in MessagePack-CSharp fails to use the security-aware equality comparer provided by the application's configuration, defaulting instead to a standard comparer. This vulnerability belongs to the Inefficient Algorithmic Complexity (CWE-407) class. An attacker can exploit this by providing a serialized payload containing many keys that result in hash collisions, degrading dictionary insertion performance from constant time to quadratic time. This bypasses the protections intended by the MessagePackSecurity.UntrustedData setting. The issue is fixed in versions 2.5.301 and 3.1.7.

## Affected products

- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48516
- GHSA-q2h6-ghwm-5qm8

## Timeline

- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory reviewed and updated with patch information

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)
- [MessagePack for C# uncontrolled recursion in DynamicUnionResolver](https://junglewise.ai/threats/cve-2026-48513-messagepack-for-c-uncontrolled-recursion-in-dynamicunionresolver)