CVE-2026-48511

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A denial of service vulnerability (CVE-2026-48511) has been identified in the ExpandoObject formatter of MessagePack-CSharp, which allows a remote attacker to cause excessive CPU and memory consumption by sending an untrusted map that contains a large number of distinct keys. The work performed grows quadratically with the number of keys, so a modestly sized payload can consume resources far out of proportion to its size and make a server unresponsive under concurrent load.

Per CWE-407: Inefficient Algorithmic Complexity, Inefficient Algorithmic Complexity is defined as an algorithm in a product having an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

This issue affects multiple versions of MessagePack-CSharp, including all releases before 2.5.301 on the 2.x line and 3.0.0 up to but not including 3.1.7 on the 3.x line. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack-CSharp
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in multiple versions of MessagePack-CSharp. When deserializing an untrusted map into a dynamic object, the ExpandoObjectFormatter.Deserialize method populates a System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add once for every entry in the incoming map. ExpandoObject keeps its member names in array-like internal structures, so each Add can perform a linear scan of the members already present and copy the backing array as it grows. Inserting a map that contains many distinct keys therefore degrades to quadratic time and allocation cost: the total work grows with the square of the number of keys. A remote, unauthenticated attacker who can reach an endpoint that deserializes attacker-controlled MessagePack maps into ExpandoObject can send a payload carrying a large number of distinct keys, driving CPU exhaustion and allocation churn that is disproportionate to the payload size and that can make the service unresponsive when many such requests arrive concurrently.

This vulnerability has been present since at least MessagePack 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)