CVE-2026-48516

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description The InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> using the default equality comparer instead of the security-aware comparer provided by options.Security.GetEqualityComparer<TKey>(). This omission enables a hash-collision CPU denial of service against ILookup<TKey,TElement>, even in applications configured with an untrusted-data security posture.

Recommendations Update to version 2.5.301. Update to version 3.1.7.