EUVD-2026-38387
GHSA-2f33-pr97-265q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network reachable via HTTP with no authentication required (AV:N, PR:N), but exploitation requires specific constructor usage and dictionary-typed models (AC:H); confidentiality is unaffected, integrity and availability impacts are both Low.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash-collision denial-of-service attacks. The parameterless MessagePackInputFormatter() constructor silently applies MessagePackSecurity.TrustedData to HTTP request bodies - data that by definition crosses an untrusted boundary - bypassing the hash-seed randomization that MessagePackSecurity.UntrustedData provides. Vendor-released patches are available in versions 2.5.301 and 3.1.7; no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
MessagePack for C
(CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp) is a high-performance binary serialization library for .NET, commonly integrated into ASP.NET Core MVC pipelines via the MessagePackInputFormatter class. CWE-1188 (Insecure Default Initialization of Resource) describes the root cause precisely: the parameterless constructor defaults to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData, a mode that omits hash-seed randomization as a performance optimization intended only for internally sourced, application-controlled data. When applied to inbound HTTP request bodies, this creates a HashDoS surface: an attacker can craft MessagePack-encoded payloads containing keys engineered to collide in the same hash bucket, degrading O(1) dictionary lookups to O(n) and exhausting CPU. The MessagePackSecurity.UntrustedData mode randomizes hash seeds per-process to neutralize this attack class. The vulnerability exists precisely because the formatter's design context (HTTP boundary) and its default security context (TrustedData) are mismatched.
RemediationAI
Upgrade to MessagePack-CSharp 2.5.301 (v2 branch) or 3.1.7 (v3 branch) as confirmed by the vendor advisory at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2f33-pr97-265q. If an immediate upgrade is blocked, use the explicit constructor overload instead of the parameterless one: pass MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData) as the options argument when instantiating MessagePackInputFormatter. This directly activates hash-seed randomization and eliminates the vulnerable default without requiring a library version change, though the library upgrade should still be applied at the earliest opportunity. As an additional compensating control, applying ASP.NET Core request-body size limits and endpoint-level rate limiting will reduce the computational leverage an attacker gains from any single crafted request, though these do not address the root cause. Note that switching to UntrustedData may introduce a small per-request performance overhead relative to the TrustedData mode.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today