MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7,
    InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>>
    with the default equality comparer instead of the security-aware comparer supplied by
    options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of
    service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data
    security posture This vulnerability is fixed in 2.5.301 and 3.1.7. (CVE-2026-48516)

ID	Name	Product	Family	Type	Severity
458924	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458924	Echo: MessagePack: security update to 2.5.172+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443985	SCA: security update for MessagePack (GHSA-q2h6-ghwm-5qm8)	Tenable Cloud Security	SCA Checks	Local	medium
443985	SCA: security update for MessagePack (GHSA-q2h6-ghwm-5qm8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48516

medium

Tenable Plugins

medium

medium

medium

medium