{"id":"CVE-2026-48511","title":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","summary":"MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps","severity":"medium","cvss":7.5,"cwe":["CWE-407"],"vendor":"MessagePack","product":"MessagePack","ecosystem":"nuget","affected":["MessagePack < 2.5.301","MessagePack >= 3.0, < 3.1.7"],"patched":["MessagePack 2.5.301","MessagePack 3.1.7"],"published":"2026-06-25","updated":"2026-06-25","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2x83-8g95-xh59","references":[{"url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2x83-8g95-xh59"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48511"},{"url":"https://github.com/advisories/GHSA-2x83-8g95-xh59"}],"tags":["ghsa","nuget"],"epss":0.00405,"epssPercentile":0.3456,"ingestedAt":"2026-06-26T16:43:14.227Z","slug":"CVE-2026-48511","body":"## Overview\n\n## Summary\n\n`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary<string, object>.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.\n\nFor large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.\n\n## Impact\n\nApplications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.\n\nA hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.\n\nThis is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`'s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.\n\n## Affected components\n\n- Package: `MessagePack`\n- APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver`\n- Data type: `System.Dynamic.ExpandoObject`\n- Finding ID: `MESSAGEPACKCSHARP-102`\n\n## Patches\n\nFixes are prepared and will be released in coordinated patch versions.\n\nUpgrade guidance:\n\n1. Upgrade `MessagePack` to the patched version for your release line.\n2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.\n\nPotential fixes include applying a map-entry count limit for `ExpandoObject` under untrusted-data settings, buffering into a security-aware dictionary before materializing a bounded `ExpandoObject`, or otherwise rejecting maps large enough to trigger quadratic behavior.\n\n## Workarounds\n\nPatching is recommended.\n\nUntil a patched version is available, avoid deserializing untrusted payloads into `ExpandoObject`. Prefer strongly typed DTOs or dictionaries with security-aware comparers and explicit count limits. Enforce request-size and map-entry limits at the transport or application layer.\n\n## Resources\n\n- `MESSAGEPACKCSHARP-102`: `ExpandoObjectFormatter` quadratic insertion behavior\n- CWE-407: Inefficient Algorithmic Complexity\n\n## Affected packages\n\n- `MessagePack < 2.5.301`\n- `MessagePack >= 3.0, < 3.1.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `MessagePack 2.5.301`\n- `MessagePack 3.1.7`","depth":"sunlit","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}