CVE-2026-48516

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A denial of service (DoS) vulnerability (CVE-2026-48516) has been identified in the InterfaceLookupFormatter of the MessagePack library, which allows a remote attacker to force worst-case hash-collision behavior when an application deserializes untrusted data into an ILookup collection, exhausting CPU and rendering the application unresponsive.

Per CWE-407: Inefficient Algorithmic Complexity, Inefficient Algorithmic Complexity is defined as an algorithm in a product having an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

This issue affects multiple versions of MessagePack-CSharp, including all 2.x releases before 2.5.301 and all 3.x releases from 3.0 up to but not including 3.1.7. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.3.

‍

Details

Module Info

• Product: MessagePack-CSharp
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.301
  • MessagePack >= 3.0 < 3.1.7
  • NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.3
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: MessagePack on NuGet
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.3

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in multiple versions of MessagePack-CSharp. When deserializing an ILookup collection, the InterfaceLookupFormatter builds its internal dictionary using the default equality comparer instead of the security-aware comparer returned by options.Security.GetEqualityComparer, which every other hash-based collection formatter in the library uses. Because the security-aware comparer is bypassed, a remote attacker who can supply untrusted MessagePack data that is deserialized into an ILookup member can include a large number of keys crafted to collide under the default hash comparer. Those collisions degrade dictionary insertion from amortized constant time to quadratic behavior, so a comparatively small payload forces the process to consume a disproportionate amount of CPU and can render the application unresponsive, resulting in Denial of Service. Enabling the MessagePackSecurity.UntrustedData hardening setting does not mitigate this issue, because this particular formatter never consulted the configured comparer. Applications are exposed when they deserialize untrusted input into a schema that contains an ILookup member with a key type for which attacker-controlled hash collisions are feasible.

This vulnerability has been present since at least MessagePack-CSharp 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.301
  • MessagePack >= 3.1.7
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.3 or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)