CVE-2026-48509

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A vulnerability (CVE-2026-48509) exists in the MessagePackInputFormatter component of the MessagePack for C# (MessagePack) library used by ASP.NET Core MVC, where the parameterless constructor initializes the formatter with insecure default serializer options that resolve to the MessagePackSecurity.TrustedData posture, even though the formatter reads HTTP request bodies that cross a trust boundary. This allows a remote, unauthenticated client to submit MessagePack request bodies that are deserialized under a trusted-data posture, enabling algorithmic-complexity (hash-collision) denial-of-service attacks against dictionary-like model properties.

Per CWE-1188: Initialization of a Resource with an Insecure Default, Initialization of a Resource with an Insecure Default is defined as a product initializing or setting a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

This issue affects MessagePack for C# versions prior to 2.5.301 and versions 3.0.0 up to but not including 3.1.7. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack for C# (MessagePack-CSharp)
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: MessagePack on NuGet
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package, specifically the MessagePackInputFormatter type in the MessagePack.AspNetCoreMvcFormatter namespace used with ASP.NET Core MVC. The parameterless MessagePackInputFormatter() constructor initializes the formatter from MessagePackSerializerOptions.Standard, whose security posture is MessagePackSecurity.TrustedData. That posture omits the hardening the library applies to hostile input, including the hash-collision-resistant handling of hash-based collections. Because the input formatter is designed to deserialize ASP.NET Core MVC request bodies, which commonly arrive from unauthenticated clients across an HTTP trust boundary, a remote attacker can post a application/x-msgpack body that binds to a model containing hash-based collections such as Dictionary or HashSet keys, supplying colliding keys that force quadratic insertion work and exhaust CPU, resulting in a denial of service. Applications that instead pass the constructor overload an options value hardened with MessagePackSecurity.UntrustedData are not affected. This vulnerability has been present since at least MessagePack for C# 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Applications that must keep the MessagePack MVC input formatter can harden it by supplying untrusted-data options to the constructor overload rather than relying on the parameterless default, for example by adding new MessagePackInputFormatter(MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData)) to options.InputFormatters.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)