Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| MessagePack | nuget | < 2.5.301 | 2.5.301 |
| MessagePack | nuget | >= 3.0, < 3.1.7 | 3.1.7 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-48511, is a denial-of-service issue caused by inefficient algorithmic complexity (CWE-407) in how MessagePack-CSharp handles deserialization into System.Dynamic.ExpandoObject. The root cause is the ExpandoObject's internal data structure, which results in O(n^2) performance when adding a large number of new members. The analysis of the security patch, specifically commit 25a3493e6c531203221e56b2e862ce628cd9acaf, reveals the exact locations where this vulnerability was addressed. The patch introduces a size limit for maps being deserialized into ExpandoObject when operating in an untrusted data security mode.
Two primary functions were identified as vulnerable:
MessagePack.Formatters.ExpandoObjectFormatter.Deserialize: This is the direct formatter for ExpandoObject. The patch adds a call to a new method, ThrowIfMapTooLargeForUntrustedData, immediately after reading the map header and before entering the loop to populate the object. This prevents the expensive population process for overly large maps.
MessagePack.Resolvers.ExpandoObjectResolver+PrimitiveObjectWithExpandoMaps.DeserializeMap: This function is used by the ExpandoObjectResolver when it encounters a map that needs to be deserialized into an object. The patch adds the same check to this function, ensuring that even when ExpandoObject is used implicitly as part of a larger object graph, the vulnerability cannot be triggered.
During exploitation, a runtime profiler would show significant time spent within these two functions, specifically in the loop that adds items to the ExpandoObject (which is an internal call to IDictionary<string, object>.Add). The patch effectively short-circuits this process by throwing an exception before the expensive operation begins.
MessagePack.Formatters.ExpandoObjectFormatter.Deserializesrc/MessagePack/Formatters/ExpandoObjectFormatter.cs
MessagePack.Resolvers.ExpandoObjectResolver+PrimitiveObjectWithExpandoMaps.DeserializeMapsrc/MessagePack/Resolvers/ExpandoObjectResolver.cs