CVE-2026-48509

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description The parameterless MessagePackInputFormatter() constructor uses default serializer options that resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. Because this formatter is designed for ASP.NET Core MVC request bodies that cross HTTP trust boundaries, this default configuration can expose applications to denial-of-service attacks. Specifically, it allows for hash-collision attacks against dictionary-like model properties, which MessagePackSecurity.UntrustedData is intended to prevent.

Recommendations Update to version 2.5.301 or later. Update to version 3.1.7 or later.