Performance Degradation in MessagePack for C# by Affected Vendor

CVE-2026-48511

What is CVE-2026-48511?

The MessagePack for C# serializer experiences a vulnerability in its ExpandoObjectFormatter.Deserialize function. In versions prior to 2.5.301 and 3.1.7, this function can lead to significant performance degradation when processing large, attacker-controlled maps. Specifically, the method utilizes IDictionary<string, object>.Add, which may trigger repeated linear scans and array copies due to the internal structure of ExpandoObject. This behavior impacts CPU and memory allocation severely, causing potential denial-of-service scenarios. This issue is particularly insidious because even with MessagePackSecurity's untrusted data settings, the dictionary's collision-resistant comparers cannot mitigate the inefficiencies of the ExpandoObject’s insertion mechanisms. The vulnerability has been addressed in subsequent releases.

References