CVE-2026-48511Medium· 7.5▾ SunlitMessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
▾ Sunlit zone — Low / medium · no exploitation signal
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.
For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals.
Applications are affected when they deserialize untrusted MessagePack maps into ExpandoObject using ExpandoObjectResolver or related resolver options.
A hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.
This is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from ExpandoObject's insertion model, so MessagePackSecurity.UntrustedData does not eliminate the cost.
MessagePackExpandoObjectFormatter.Deserialize, ExpandoObjectResolverSystem.Dynamic.ExpandoObjectMESSAGEPACKCSHARP-102Fixes are prepared and will be released in coordinated patch versions.
Upgrade guidance:
MessagePack to the patched version for your release line.Potential fixes include applying a map-entry count limit for ExpandoObject under untrusted-data settings, buffering into a security-aware dictionary before materializing a bounded ExpandoObject, or otherwise rejecting maps large enough to trigger quadratic behavior.
Patching is recommended.
Until a patched version is available, avoid deserializing untrusted payloads into ExpandoObject. Prefer strongly typed DTOs or dictionaries with security-aware comparers and explicit count limits. Enforce request-size and map-entry limits at the transport or application layer.
MESSAGEPACKCSHARP-102: ExpandoObjectFormatter quadratic insertion behaviorMessagePack < 2.5.301MessagePack >= 3.0, < 3.1.7Upgrade to a patched release:
MessagePack 2.5.301MessagePack 3.1.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48502HighMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
CVE-2026-48516MediumMessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
CVE-2026-48109High· 8.2MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
CVE-2026-48506High· 7.5MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
CVE-2026-48509MediumMessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
CVE-2026-48510Medium· 7.5MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths