CVE-2026-48511: MessagePack for C# ExpandoObject Denial of Service

Technical summary

ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject instances by iterating through map entries and calling IDictionary<string, object>.Add for each key-value pair. ExpandoObject maintains member names in array-like structures that require linear scans and array copies during insertion; with many distinct keys, this produces O(n²) behavior. Although ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, the untrusted-data security policy cannot defend against algorithmic complexity attacks on ExpandoObject's internal insertion mechanics. The root cause is architectural: ExpandoObject's insertion implementation becomes a performance bottleneck when fed large, adversary-controlled dictionaries.

Business impact

Applications using MessagePack for C# to deserialize untrusted input could be forced into resource exhaustion. A denial of service attack requires minimal bandwidth—a single moderately-sized malicious MessagePack payload can consume significant CPU and memory, potentially crashing the application or degrading service for legitimate users. This is particularly dangerous in API endpoints, message queues, or any service that accepts serialized data from untrusted sources. Organizations relying on MessagePack for C# deserialization of external data face immediate availability risk.

Affected systems

MessagePack for C# versions before 2.5.301 and 3.1.7 are affected. The vulnerability exists in the deserialization code path for ExpandoObject types, so applications must both use the affected library versions and deserialize ExpandoObject instances from untrusted sources to be at risk. Verify your dependency declarations and deserialization patterns against your actual usage.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no special conditions—an attacker simply sends a crafted MessagePack message with a large map to a vulnerable endpoint. The network attack vector is straightforward, and the resources required to mount the attack (generating a malicious payload) are minimal. The only limiting factor is whether the application actually deserializes ExpandoObject types from untrusted input; applications that only deserialize other types are not affected.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the 2.x line, or 3.1.7 or later for the 3.x line. These versions fix the quadratic insertion behavior. After patching, no application code changes are required. If immediate patching is not possible, consider restricting deserialization of ExpandoObject types from untrusted sources or implementing rate limiting and resource quotas on deserialization operations.

Patch guidance

Update your NuGet package reference for MessagePack to 2.5.301 or 3.1.7 as appropriate for your major version. Consult the official MessagePack-CSharp GitHub repository and release notes to confirm the exact patched versions and any breaking changes. After updating, recompile and test your application against your existing test suite to ensure compatibility.

Detection guidance

Monitor for unusual CPU spikes and memory growth during deserialization operations, particularly if tied to incoming network requests or message processing. Log the size and key count of ExpandoObject instances being deserialized; unusually large maps from untrusted sources may indicate an attack. Implement metrics around deserialization latency—quadratic behavior will manifest as disproportionate slowdown as payload complexity increases. Code review: scan for MessagePackSerializer.Deserialize or Unpacker.Unpack calls that operate on untrusted input and involve ExpandoObject types.

Why prioritize this

The CVSS 7.5 HIGH score reflects network-exploitable denial of service with no user interaction required. While the attack vector is narrow (must deserialize ExpandoObject specifically), the impact is immediate and affects availability. Organizations using MessagePack for C# in production API or message-processing services should patch within weeks, not months. Lower priority for internal-use or trusted-data-only scenarios.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is assigned because: Attack Vector is Network (AV:N), Attack Complexity is Low (AC:L), Privileges Required is None (PR:N), User Interaction is None (UI:N), Scope is Unchanged (S:U), Confidentiality impact is None (C:N), Integrity impact is None (I:N), and Availability impact is High (A:H). The severity reflects that an unauthenticated remote attacker can reliably trigger denial of service through a single crafted message, but no data breach or integrity violation occurs.

Frequently asked questions