---
id: CVE-2026-48511
title: >-
  MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion
  work on untrusted maps
summary: >-
  MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion
  work on untrusted maps
severity: medium
cvss: 7.5
cwe:
  - CWE-407
vendor: MessagePack
product: MessagePack
ecosystem: nuget
affected:
  - MessagePack < 2.5.301
  - 'MessagePack >= 3.0, < 3.1.7'
patched:
  - MessagePack 2.5.301
  - MessagePack 3.1.7
published: '2026-06-25'
updated: '2026-06-25'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2x83-8g95-xh59'
references:
  - url: >-
      https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2x83-8g95-xh59
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48511'
  - url: 'https://github.com/advisories/GHSA-2x83-8g95-xh59'
tags:
  - ghsa
  - nuget
epss: 0.00405
epssPercentile: 0.31946
ingestedAt: '2026-06-26T16:43:14.227Z'
---

## Overview

## Summary

`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary<string, object>.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.

For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.

## Impact

Applications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.

A hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.

This is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`'s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.

## Affected components

- Package: `MessagePack`
- APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver`
- Data type: `System.Dynamic.ExpandoObject`
- Finding ID: `MESSAGEPACKCSHARP-102`

## Patches

Fixes are prepared and will be released in coordinated patch versions.

Upgrade guidance:

1. Upgrade `MessagePack` to the patched version for your release line.
2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.

Potential fixes include applying a map-entry count limit for `ExpandoObject` under untrusted-data settings, buffering into a security-aware dictionary before materializing a bounded `ExpandoObject`, or otherwise rejecting maps large enough to trigger quadratic behavior.

## Workarounds

Patching is recommended.

Until a patched version is available, avoid deserializing untrusted payloads into `ExpandoObject`. Prefer strongly typed DTOs or dictionaries with security-aware comparers and explicit count limits. Enforce request-size and map-entry limits at the transport or application layer.

## Resources

- `MESSAGEPACKCSHARP-102`: `ExpandoObjectFormatter` quadratic insertion behavior
- CWE-407: Inefficient Algorithmic Complexity

## Affected packages

- `MessagePack < 2.5.301`
- `MessagePack >= 3.0, < 3.1.7`

## Remediation

Upgrade to a patched release:

- `MessagePack 2.5.301`
- `MessagePack 3.1.7`