CVE-2026-48516

Katalog CVE

CVSS 7.5 · High EPSS 0,40%

Kerentanan Inefficient Algorithmic Complexity pada messagepack. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-q2h6-ghwm-5qm8 mitigasi · advisory vendor