{"id":"CVE-2026-48516","aliases":["GHSA-q2h6-ghwm-5qm8"],"url":"https://o3.security/vulnerability/CVE-2026-48516","summary":"MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings","details":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.","published":"2026-06-22T21:09:51.787Z","modified":"2026-07-15T01:48:57.779035486Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"MessagePack","fixedVersion":"2.5.301"},{"ecosystem":"NuGet","name":"MessagePack","fixedVersion":"3.1.7"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48516.json"},{"type":"ADVISORY","url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-q2h6-ghwm-5qm8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48516"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:57.779035486Z"}}