6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48509

CVE-2026-48509: MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for ASP.NET Core MVC request bodies, which commonly cross an HTTP trust boundary. This insecure default can expose applications to denial-of-service attacks that MessagePackSecurity.UntrustedData is intended to mitigate, such as hash-collision attacks against dictionary-like model properties. This vulnerability is fixed in 2.5.301 and 3.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48509

CVE-2026-48509:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
MessagePack	nuget	< 2.5.301	2.5.301
MessagePack	nuget	>= 3.0, < 3.1.7	3.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the MessagePack.AspNetCoreMvcFormatter package, where the MessagePackInputFormatter's parameterless constructor defaults to an insecure TrustedData security setting. This is dangerous because this formatter is intended for use with ASP.NET Core MVC, where it processes HTTP request bodies that are inherently untrusted.

The analysis identified two key functions. The primary vulnerable function is the MessagePackInputFormatter() parameterless constructor itself. This constructor sets up the insecure default configuration. When a developer uses new MessagePackInputFormatter(), they are unknowingly opting into a vulnerable configuration.

The second function, ReadRequestBodyAsync, is where the vulnerability manifests. This function takes the insecurely configured options and uses them to deserialize the request body. An attacker can craft a malicious MessagePack payload that, when deserialized by this function, can cause a denial-of-service, for example, through a hash collision attack on dictionary-like structures.

The fix, as described in the advisory, is to change the default of the parameterless constructor to use MessagePackSecurity.UntrustedData. My analysis confirms that any runtime profile of an exploitation attempt would show these two functions in the call stack, as one sets up the vulnerability and the other executes the dangerous operation.

Vulnerable functions

MessagePack.AspNetCoreMvcFormatter.MessagePackInputFormatter.MessagePackInputFormatter

src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs

The parameterless constructor for `MessagePackInputFormatter` initializes the formatter with `MessagePackSerializerOptions.Standard`, which uses `MessagePackSecurity.TrustedData` by default. When this formatter is used in an ASP.NET Core application to process request bodies, it deserializes untrusted data with settings meant for trusted data. This exposes the application to denial-of-service attacks, such as those based on hash collisions in dictionaries, because the security mitigations present in `UntrustedData` are not applied.

MessagePack.AspNetCoreMvcFormatter.MessagePackInputFormatter.ReadRequestBodyAsync

src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs

This method is the entry point for reading and deserializing the incoming MessagePack payload from an HTTP request. It uses the `MessagePackSerializerOptions` configured on the formatter. Because the default constructor creates an insecure configuration, this function will perform the dangerous deserialization, making it a key part of the vulnerable execution flow. An attacker would send a malicious MessagePack payload that, when processed by this function, could trigger a denial-of-service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.