CVE-2026-48516: Messagepack

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

Affected products

• Messagepack Messagepack: before 2.5.301 (fixed in 2.5.301); from 3.0.3, before 3.1.7 (fixed in 3.1.7)

Published 2026-06-22. Last modified 2026-06-25.