Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔵 MessagePack-CSharp: InterfaceLookupFormatter Security Comparer Bypass (#CVE-2026-48516) -DC-Jun2026-654 https://dailycve.com/messagepack-csharp-interfacelookupformatter-security-comparer-bypass-cve-2026-48516-dc-jun2026-654/
Post summary
The post announces the disclosure of CVE-2026-48516, a security comparer bypass in MessagePack-CSharp, but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | messagepack | messagepack | - | c\# | - |