MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6 options.Security.GetEqualityComparer algorithmic complexity

Summaryinfo

A vulnerability classified as problematic was found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6. This vulnerability affects the function options.Security.GetEqualityComparer. Such manipulation leads to algorithmic complexity. This vulnerability is listed as CVE-2026-48516. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6 and classified as problematic. Affected by this issue is the function options.Security.GetEqualityComparer. The manipulation with an unknown input leads to a algorithmic complexity vulnerability. Using CWE to declare the problem leads to CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. Impacted is availability. CVE summarizes:

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter constructs an internal Dictionary> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer(). This formatter omission allows hash-collision CPU denial of service against ILookup even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-48516 since 05/21/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.5.301 or 3.1.7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• MessagePack-CSharp

Name

• MessagePack for C#

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.300
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion