CVE-2026-48509: MessagePack for C# insecure default options in ASP.NET Core input formatter
MessagePack for C# versions before 2.5.301, and the range from 3.0.3 up to but not including 3.1.7, use a parameterless input formatter constructor whose default options select the trusted-data security profile. This can expose ASP.NET Core MVC applications to denial-of-service attacks, such as hash-collision attacks against dictionary-like model properties. The fix is available in 2.5.301 and 3.1.7; the NVD assigns a CVSS 3.1 score of 9.1, and no confirmed exploitation appears in the sources consulted.
Overview
MessagePack for C# is a MessagePack serializer library for .NET. According to the record, its parameterless input formatter constructor, used for ASP.NET Core MVC request bodies, applies default serializer options that favor trusted data handling. The weakness is classified as CWE-1188, insecure default initialization of a resource.
Impact
- The default configuration may allow denial-of-service conditions, such as hash-collision attacks against dictionary-like model properties.
- Request bodies commonly cross an HTTP trust boundary, so the default is a relevant risk for internet-facing services.
- The record states that the untrusted-data security profile is intended to mitigate these attacks, but the default does not select it.
Affected products and versions
- The record lists MessagePack for C# versions below 2.5.301.
- The record lists versions from 3.0.3 up to but not including 3.1.7.
- The sources consulted do not describe versions between 2.5.301 and 3.0.3.
Exploitation status
The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade to MessagePack for C# 2.5.301 or later, or to 3.1.7 or later, depending on the release line in use.
- Review the vendor advisory for the mitigation details: GitHub Security Advisory GHSA-2f33-pr97-265q.
- Until upgrading is possible, reduce exposure of request body deserialization to untrusted clients and review how input formatters are configured in your code.
Detection guidance
- Inventory projects that reference MessagePack for C# and record the installed versions.
- Check whether ASP.NET Core MVC endpoints rely on the default input formatter configuration.
- Monitor request sizes, processing time and CPU usage on endpoints that accept MessagePack payloads, since sustained resource growth may indicate denial-of-service attempts.
Limitations of the available information
The record does not describe the exact code change in the fix, the full exploit preconditions, or the scoring rationale beyond the listed vectors. The GitHub CNA provides a CVSS 4.0 score of 6.3, while the NVD provides a CVSS 3.1 score of 9.1; the record does not explain the difference. Exposure of a given application depends on its own configuration, which is not known from the record.
Frequently asked questions
What is the core weakness in CVE-2026-48509?
The parameterless input formatter constructor uses default serializer options that select the trusted-data security profile, which the record describes as an insecure default.
Which versions are fixed?
According to the record, the issue is fixed in MessagePack for C# 2.5.301 and 3.1.7. The record does not state how versions between 2.5.301 and 3.0.3 are handled.
Is this CVE known to be actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.