{"id":"CVE-2026-48511","aliases":["AZL-113024","EUVD-2026-38385","GHSA-2x83-8g95-xh59"],"status":"published","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00405,"percentile":0.35087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-06-22T21:14:54Z","modified":"2026-11-10T14:18:01Z","fixes":[{"ecosystem":"NuGet","package":"MessagePack","fixed_in":["2.5.301","3.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.301"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.1.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.301"}]}],"versions":["0.1.0-beta","0.2.0-beta","0.2.1-beta","0.2.2-beta","0.2.3-beta","0.3.0-beta","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.7.0","0.7.2","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.1.1","1.1.2","1.2.0","1.2.0.1","1.2.0.2","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.1.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.0.1","1.5.0.2","1.5.1","1.6.0","1.6.0.1","1.6.0.2","1.6.0.3","1.6.1","1.6.1.1","1.6.1.2","1.6.2","1.7.0","1.7.1","1.7.2","1.7.3","1.7.3.1","1.7.3.2","1.7.3.3","1.7.3.4","1.7.3.7","1.8.71-beta","1.8.74","1.8.80","1.9.11","1.9.3","1.9.3-g129239b107","2.0.107-alpha","2.0.108-alpha","2.0.110-alpha","2.0.110-alpha-g1e44a9106f","2.0.119-beta","2.0.123-beta","2.0.171-beta","2.0.204-beta","2.0.221-beta","2.0.231-rc","2.0.270-rc","2.0.299-rc","2.0.323","2.0.335","2.1.115","2.1.143","2.1.152","2.1.165","2.1.194","2.1.80","2.1.90","2.2.113","2.2.36-alpha","2.2.44-rc","2.2.60","2.2.85","2.3.112","2.3.58-alpha","2.3.73-alpha","2.3.75","2.3.85","2.4.14-alpha","2.4.23-alpha","2.4.35","2.4.59","2.5.103","2.5.108","2.5.124","2.5.129","2.5.140","2.5.168","2.5.171","2.5.172","2.5.187","2.5.192","2.5.198","2.5.205","2.5.64-alpha","2.5.94"]},{"source":"osv","ecosystem":"NuGet","package":"MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.111-alpha","3.0.129-beta","3.0.134-beta","3.0.208-rc-0001","3.0.3","3.0.300","3.0.308","3.0.54-alpha","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]}],"products":[{"vendor":"messagepack","product":"messagepack"},{"vendor":"messagepack-csharp","product":"messagepack-csharp"}],"references":[{"url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2x83-8g95-xh59","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48511","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2x83-8g95-xh59"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48511.json","tags":["advisory"]},{"url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48511","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","status":"published","published":"2026-06-22T21:14:54.127Z","modified":"2026-06-25T15:08:00.418Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-38385","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","status":"published","published":"2026-06-22T21:14:54Z","modified":"2026-06-25T15:08:00Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:25.700423Z"}],"ghsa":[{"id":"GHSA-2x83-8g95-xh59","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","description":"## Summary\n\n`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary\u003cstring, object\u003e.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.\n\nFor large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.\n\n## Impact\n\nApplications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.\n\nA hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.\n\nThis is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`'s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.\n\n## Affected components\n\n- Package: `MessagePack`\n- APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver`\n- Data type: `System.Dynamic.ExpandoObject`\n- Finding ID: `MESSAGEPACKCSHARP-102`\n\n## Patches\n\nFixes are prepared and will be released in coordinated patch versions.\n\nUpgrade guidance:\n\n1. Upgrade `MessagePack` to the patched version for your release line.\n2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.\n\nPotential fixes include applying a map-entry count limit for `ExpandoObject` under untrusted-data settings, buffering into a security-aware dictionary before materializing a bounded `ExpandoObject`, or otherwise rejecting maps large enough to trigger quadratic behavior.\n\n## Workarounds\n\nPatching is recommended.\n\nUntil a patched version is available, avoid deserializing untrusted payloads into `ExpandoObject`. Prefer strongly typed DTOs or dictionaries with security-aware comparers and explicit count limits. Enforce request-size and map-entry limits at the transport or application layer.\n\n## Resources\n\n- `MESSAGEPACKCSHARP-102`: `ExpandoObjectFormatter` quadratic insertion behavior\n- CWE-407: Inefficient Algorithmic Complexity","status":"published","published":"2026-06-25T19:36:23Z","modified":"2026-06-25T19:36:24Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2026-48511","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","status":"published","published":"2026-06-22T22:16:47.84Z","modified":"2026-06-25T16:16:35.977Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-48511","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","status":"published","published":"2026-06-22T21:14:54.127Z","modified":"2026-10-28T02:30:28.391978676Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-2x83-8g95-xh59","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","description":"## Summary\n\n`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary\u003cstring, object\u003e.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.\n\nFor large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.\n\n## Impact\n\nApplications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.\n\nA hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.\n\nThis is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`'s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.\n\n## Affected components\n\n- Package: `MessagePack`\n- APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver`\n- Data type: `System.Dynamic.ExpandoObject`\n- Finding ID: `MESSAGEPACKCSHARP-102`\n\n## Patches\n\nFixes are prepared and will be released in coordinated patch versions.\n\nUpgrade guidance:\n\n1. Upgrade `MessagePack` to the patched version for your release line.\n2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.\n\nPotential fixes include applying a map-entry count limit for `ExpandoObject` under untrusted-data settings, buffering into a security-aware dictionary before materializing a bounded `ExpandoObject`, or otherwise rejecting maps large enough to trigger quadratic behavior.\n\n## Workarounds\n\nPatching is recommended.\n\nUntil a patched version is available, avoid deserializing untrusted payloads into `ExpandoObject`. Prefer strongly typed DTOs or dictionaries with security-aware comparers and explicit count limits. Enforce request-size and map-entry limits at the transport or application layer.\n\n## Resources\n\n- `MESSAGEPACKCSHARP-102`: `ExpandoObjectFormatter` quadratic insertion behavior\n- CWE-407: Inefficient Algorithmic Complexity","status":"published","published":"2026-06-25T19:36:23Z","modified":"2026-06-25T19:56:40.725189Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"AZL-113024","title":"CVE-2026-48511 affecting package python-msgpack 1.2.3-1","description":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary\u003cstring, object\u003e.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.","status":"published","published":"2026-06-22T22:16:47Z","modified":"2026-11-10T14:18:01.508347652Z","updated_at":"2026-11-10T15:02:19.085067Z"}]}}