CVE-2026-48509 is an insecure default in MessagePack for C#. The parameterless MessagePackInputFormatter constructor uses trusted data settings for ASP.NET Core request bodies. NVD scores it 9.1, while the maintainers rate it moderate. Upgrade to 2.5.301 or 3.1.7, or pass untrusted data options explicitly.
What's affected
The NuGet package MessagePack in versions from 0.0 up to but not including 2.5.300, and from 3.0 up to but not including 3.1.7, as the GitHub advisory states it. The patched versions are 2.5.301 and 3.1.7. The affected component is the MessagePack.AspNetCoreMvcFormatter package.
You are affected only if your application registers new MessagePackInputFormatter() with no options, so request bodies from untrusted clients are read with the trusted data posture. Applications that already pass untrusted data options are not in that situation.
Note the severity gap: NVD lists CVSS 9.1, and the maintainers' advisory lists moderate, 6.3 on CVSS 4.0, with denial of service as the described impact.
How to check if you're exposed
List MessagePack packages, including transitive ones, and search your code for the constructor.
dotnet list package --include-transitive | grep -i messagepack
grep -rn "new MessagePackInputFormatter()" --include=*.cs .
On Windows, use findstr in place of grep. A match on the constructor with empty parentheses is the pattern the advisory describes.
What to do now
- Upgrade MessagePack and MessagePack.AspNetCoreMvcFormatter to 2.5.301 or 3.1.7, keeping companion packages on matching versions.
- Pass explicit options when you register the formatter, as the code block below shows.
- Apply request size limits and model validation suited to the service.
- Review models that contain dictionary or set properties, since hash based collections are the stated target.
Why it matters
The class is CWE-1188, initialization of a resource with an insecure default. Nothing is broken in the parser itself. The risk is that the easy way to set up the formatter picks a trust level meant for data you produced yourself, at a spot where data comes from the internet.
The advisory names algorithmic complexity attacks using colliding keys in hash based collections as the concern, which is a denial of service risk. That is why the maintainers rate it lower than the NVD score suggests. The record does not mark it as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
The workaround from the advisory:
options.InputFormatters.Add(new MessagePackInputFormatter(
MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData)));
Paste your lockfile or manifest into the free in-browser dependency scan to see whether MessagePack is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do NVD and the maintainers disagree on severity?
They score different impact. The maintainers describe a denial of service from an insecure default, while NVD's vector counts high integrity and availability impact. Plan for the fix either way.
Sources
Last reviewed: 19 October 2026.
