CVE-2026-48516: MessagePack for C# Hash Collision DoS Vulnerability

Technical summary

InterfaceLookupFormatter<TKey,TElement> in affected versions constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> using the default equality comparer rather than invoking options.Security.GetEqualityComparer<TKey>(), which would provide cryptographic hash randomization or collision-resistant logic. This omission allows attackers to construct hash collisions against ILookup<TKey,TElement> deserialization, triggering quadratic-time dictionary operations and consuming CPU resources. The vulnerability is rooted in inconsistent application of the library's own security architecture: other formatters respect the configured equality comparer, but this formatter does not.

Business impact

Applications relying on MessagePack for C# to safely deserialize untrusted data—such as APIs receiving JSON or binary payloads from external sources—face targeted denial-of-service risk. An attacker can send a single malicious payload that consumes significant CPU, degrading availability for legitimate users. This is particularly concerning for cloud-based services where resource exhaustion may trigger unexpected scaling costs or service-level agreement violations. Organizations that have already invested in security posture configuration (via options.Security) discover that setting was incomplete, increasing the risk that their trust in the library was misplaced.

Affected systems

MessagePack for C# versions prior to 2.5.301 (v2.x line) and prior to 3.1.7 (v3.x line) are affected. Any application using MessagePack for C# with ILookup<TKey,TElement> deserialization on untrusted data is at risk. Applications not using ILookup deserialization, or only deserializing trusted data, are unaffected. Verify your dependency version using your package manager or runtime reflection.

Exploitability

Exploitation requires no authentication, no user interaction, and no special network access—an attacker simply sends a crafted binary payload. The attack is network-accessible and reliable. The barrier to exploitation is low: an attacker needs only knowledge of the hash function and the ability to construct colliding keys for the untrusted data format. However, real-world exploitation depends on the application's exposure (whether it accepts external MessagePack input) and the specific data types in use. Proof-of-concept development would be straightforward for an attacker with hash-collision expertise.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later for the v2.x line, or to 3.1.7 or later for the v3.x line. These versions restore the security-aware equality comparer to InterfaceLookupFormatter. After patching, recompile and redeploy affected applications. No configuration changes are required; the fix is automatic upon upgrade.

Patch guidance

1. Identify all projects consuming MessagePack for C# via your package manager (NuGet, dotnet add package, or packages.config). 2. Update the package reference to version 2.5.301+ (if on v2.x) or 3.1.7+ (if on v3.x). 3. Run full regression testing, particularly for code paths that deserialize ILookup objects. 4. Deploy to development and staging environments first to validate compatibility. 5. Schedule production deployment during a change window; the upgrade is generally low-risk but should not be emergency-patched without testing.

Detection guidance

Monitor for CPU spikes or performance degradation correlated with incoming MessagePack deserialization traffic. Log the MessagePack versions in use across your infrastructure. Consider instrumentation: if your application deserializes ILookup objects, add metrics around deserialization time and payload size to detect anomalies. Host intrusion detection or application performance monitoring tools may flag sustained CPU consumption from a single connection as suspicious. Review application logs for exceptions during deserialization of malformed input, which may indicate attack attempts.

Why prioritize this

This vulnerability merits prompt attention because it defeats an explicitly configured security feature (options.Security) and allows unauthenticated, remotely triggered denial of service. The attack surface is broad (any network-exposed MessagePack endpoint), the fix is straightforward (a package upgrade), and the impact is tangible (availability loss). While not critical in the CVSS sense (no data breach or code execution), the combination of ease of exploitation, architectural bypass, and guaranteed CPU impact makes it a practical priority for any team using MessagePack on untrusted input.

Risk score, explained

CVSS 7.5 (HIGH) reflects a network-accessible, low-complexity attack with no prerequisites that results in high availability impact and no confidentiality or integrity compromise. The score properly captures the denial-of-service nature and attack ease, though organizations with limited MessagePack exposure or defense-in-depth protections (rate limiting, CPU caps) may perceive lower operational risk.

Frequently asked questions