PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48511 MessagePack-CSharp CVE debrief

CVE-2026-48511 is a denial of service vulnerability in MessagePack for C# due to inefficient ExpandoObjectFormatter.Deserialize method. The issue arises from the method's quadratic CPU and allocation behavior when handling large, attacker-controlled maps. This vulnerability is fixed in versions 2.5.301 and 3.1.7. Users should update to these versions to mitigate the issue. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity. It is recommended that users take immediate action to protect their systems.

Vendor
MessagePack-CSharp
Product
Unknown
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-25
Advisory published
2026-06-22
Advisory updated
2026-06-25

Who should care

Developers and administrators using MessagePack for C# versions prior to 2.5.301 or 3.1.7 should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest versions and monitoring systems for potential attacks. Additionally, users who handle large amounts of data with MessagePack should be cautious of potential denial of service attacks.

Technical summary

The vulnerability is caused by the inefficient implementation of the ExpandoObjectFormatter.Deserialize method in MessagePack for C#. When handling large, attacker-controlled maps, the method exhibits quadratic CPU and allocation behavior, leading to a denial of service. The issue is not mitigated by collision-resistant dictionary comparers. The vulnerability is fixed in versions 2.5.301 and 3.1.7. Users should update to these versions to prevent potential attacks.

Defensive priority

High priority should be given to updating MessagePack for C# to versions 2.5.301 or 3.1.7. Additionally, users should monitor their systems for potential attacks and implement compensating controls to prevent denial of service.

Recommended defensive actions

  • Update MessagePack for C# to version 2.5.301 or 3.1.7
  • Monitor systems for potential attacks
  • Implement compensating controls to prevent denial of service
  • Review and update incident response plans
  • Perform vulnerability scanning and penetration testing

Evidence notes

The vulnerability is documented in the CVE record and the NVD detail page. The issue is caused by the inefficient implementation of the ExpandoObjectFormatter.Deserialize method in MessagePack for C#. The vulnerability is fixed in versions 2.5.301 and 3.1.7.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48511 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48511

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48511 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48511

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.