CVE-2026-48511

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description The ExpandoObjectFormatter.Deserialize() function populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. Because ExpandoObject maintains member names in array-like structures, inserting a large number of distinct keys can lead to repeated linear scans and array copies. When processing large attacker-controlled maps, this results in quadratic CPU and memory allocation behavior. This occurs even when ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, as collision-resistant dictionary comparers do not protect the internal insertion mechanisms of ExpandoObject.

Recommendations Update to version 2.5.301. Update to version 3.1.7.