EUVD-2026-38380
GHSA-q2h6-ghwm-5qm8
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deserialization endpoint drives AV:N; crafting valid hash-collision key sets requires non-trivial effort (AC:H); no credentials needed (PR:N); impact is bounded to partial CPU exhaustion without confidentiality or integrity consequences (A:L, C:N, I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
CPU denial of service in MessagePack for C
affects applications deserializing ILookup<TKey,TElement> types from untrusted input, exploitable even when the application has explicitly configured MessagePack's untrusted-data security posture. The InterfaceLookupFormatter constructs its internal dictionary with the default equality comparer rather than the security-aware, randomization-backed comparer provided by options.Security.GetEqualityComparer<TKey>(), silently bypassing the protection the developer believed was active. No public exploit code has been identified at time of analysis, and the CVSS 4.0 AC:H/AT:P rating reflects that exploitation requires crafting keys with deliberate hash collisions.
Technical ContextAI
MessagePack is a binary serialization format; the C
implementation (CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp) provides type-specific formatters for .NET. The InterfaceLookupFormatter<TKey,TElement> handles deserialization of LINQ's ILookup<TKey,TElement> grouping interface. During deserialization it creates an internal Dictionary<TKey, IGrouping<TKey,TElement>>; in vulnerable versions it passes no comparer to the Dictionary constructor, so EqualityComparer<TKey>.Default is used. The security-aware comparer (obtained via options.Security.GetEqualityComparer<TKey>()) typically injects per-process randomized hashing to prevent adversarial key ordering. Without it, CWE-407 (Insufficient Algorithmic Complexity Defense) applies: an attacker can engineer keys that all map to the same hash bucket, degrading dictionary insertion and lookup from O(1) amortized to O(n), causing CPU exhaustion proportional to payload size.
RemediationAI
Upgrade MessagePack for C
to version 2.5.301 (for 2.x consumers) or 3.1.7 (for 3.x consumers); these are the confirmed patched releases per the vendor advisory at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-q2h6-ghwm-5qm8. For teams unable to upgrade immediately, the most targeted compensating control is to avoid deserializing ILookup<TKey,TElement> directly from untrusted input - use a concrete Lookup<TKey,TElement> or an IEnumerable<IGrouping<TKey,TElement>> with a properly configured formatter instead, which sidesteps the vulnerable InterfaceLookupFormatter path entirely. A secondary infrastructure-level control is to enforce per-request CPU or wall-clock timeouts at the reverse proxy or ASP.NET Core middleware layer (e.g., HttpContext.RequestAborted with a timeout policy), which bounds the CPU consumption achievable per request but does not eliminate the vulnerability and may cause legitimate timeout errors under load. Neither workaround substitutes for patching.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today