{"id":"GHSA-q2h6-ghwm-5qm8","summary":"MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings","details":"## Summary\n\n`InterfaceLookupFormatter\u003cTKey,TElement\u003e` constructs an internal `Dictionary\u003cTKey, IGrouping\u003cTKey,TElement\u003e\u003e` with the default equality comparer instead of the security-aware comparer supplied by `options.Security.GetEqualityComparer\u003cTKey\u003e()`.\n\nOther hash-based collection formatters use the security-aware comparer when `MessagePackSecurity.UntrustedData` is configured. This formatter omission allows hash-collision CPU denial of service against `ILookup\u003cTKey,TElement\u003e` even when the application has opted into the untrusted-data security posture.\n\n## Impact\n\nApplications are affected when they deserialize untrusted payloads into schemas containing `ILookup\u003cTKey,TElement\u003e` with a key type for which attacker-controlled hash collisions are feasible.\n\nUnder the default comparer, many colliding keys can degrade dictionary insertion from amortized constant time to quadratic behavior. A payload of colliding keys can consume CPU for a disproportionate amount of time. This bypasses the mitigation that developers intentionally enabled by using `MessagePackSecurity.UntrustedData`.\n\n## Affected components\n\n- Package: `MessagePack`\n- API: `InterfaceLookupFormatter\u003cTKey,TElement\u003e.Create`\n- Data type: `ILookup\u003cTKey,TElement\u003e`\n- Finding ID: `MESSAGEPACKCSHARP-041`\n\n## Patches\n\nFixes are prepared and will be released in coordinated patch versions.\n\nUpgrade guidance:\n\n1. Upgrade `MessagePack` to the patched version for your release line.\n2. Upgrade companion MessagePack packages in the same dependency graph to the coordinated patched versions.\n\nThe fix should create the internal dictionary with `options.Security.GetEqualityComparer\u003cTKey\u003e()`, matching the sibling dictionary and lookup formatter behavior.\n\n## Workarounds\n\nPatching is recommended.\n\nUntil a patched version is available, avoid exposing `ILookup\u003cTKey,TElement\u003e` in DTOs that deserialize untrusted data. Use collection shapes that are already protected by the security-aware comparer path, or validate and cap collection sizes at the transport boundary.\n\n## Resources\n\n- `MESSAGEPACKCSHARP-041`: `InterfaceLookupFormatter` missing security comparer\n- CWE-407: Inefficient Algorithmic Complexity","aliases":["CVE-2026-48516"],"modified":"2026-06-25T21:56:26.281367Z","published":"2026-06-25T21:29:39Z","database_specific":{"github_reviewed_at":"2026-06-25T21:29:39Z","nvd_published_at":"2026-06-22T22:16:48Z","cwe_ids":["CWE-407"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-q2h6-ghwm-5qm8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48516"},{"type":"PACKAGE","url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp"}],"affected":[{"package":{"name":"MessagePack","ecosystem":"NuGet","purl":"pkg:nuget/MessagePack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.301"}]}],"versions":["0.1.0-beta","0.2.0-beta","0.2.1-beta","0.2.2-beta","0.2.3-beta","0.3.0-beta","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.7.0","0.7.2","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.1.1","1.1.2","1.2.0","1.2.0.1","1.2.0.2","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.1.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.0.1","1.5.0.2","1.5.1","1.6.0","1.6.0.1","1.6.0.2","1.6.0.3","1.6.1","1.6.1.1","1.6.1.2","1.6.2","1.7.0","1.7.1","1.7.2","1.7.3","1.7.3.1","1.7.3.2","1.7.3.3","1.7.3.4","1.7.3.7","1.8.71-beta","1.8.74","1.8.80","1.9.11","1.9.3","1.9.3-g129239b107","2.0.107-alpha","2.0.108-alpha","2.0.110-alpha","2.0.110-alpha-g1e44a9106f","2.0.119-beta","2.0.123-beta","2.0.171-beta","2.0.204-beta","2.0.221-beta","2.0.231-rc","2.0.270-rc","2.0.299-rc","2.0.323","2.0.335","2.1.115","2.1.143","2.1.152","2.1.165","2.1.194","2.1.80","2.1.90","2.2.113","2.2.36-alpha","2.2.44-rc","2.2.60","2.2.85","2.3.112","2.3.58-alpha","2.3.73-alpha","2.3.75","2.3.85","2.4.14-alpha","2.4.23-alpha","2.4.35","2.4.59","2.5.103","2.5.108","2.5.124","2.5.129","2.5.140","2.5.168","2.5.171","2.5.172","2.5.187","2.5.192","2.5.198","2.5.205","2.5.64-alpha","2.5.94"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q2h6-ghwm-5qm8/GHSA-q2h6-ghwm-5qm8.json"}},{"package":{"name":"MessagePack","ecosystem":"NuGet","purl":"pkg:nuget/MessagePack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.111-alpha","3.0.129-beta","3.0.134-beta","3.0.208-rc-0001","3.0.3","3.0.300","3.0.308","3.0.54-alpha","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q2h6-ghwm-5qm8/GHSA-q2h6-ghwm-5qm8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}