CVE-2026-48511

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.

• CWE-407

• https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2x83-8g95-xh59Mitigation, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48506MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48507Snipe-IT is an IT asset/license management system. A vulnera…7.1
• CVE-2026-48508Lemur manages TLS certificate creation. Prior to 1.9.1, Stri…8.8
• CVE-2026-48509MessagePack for C# is a MessagePack serializer for C#. Prior…9.1
• CVE-2026-4851GRID::Machine versions through 0.127 for Perl allows arbitra…9.8
• CVE-2026-48510MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48512MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48513MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48514MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48515MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48516MessagePack for C# is a MessagePack serializer for C#. Prior…7.5
• CVE-2026-48517MessagePack for C# is a MessagePack serializer for C#. Prior…7.5