https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:13:41.253633+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330329 EUVD-2026-330329 2026-10-06T07:13:41.304937+00:00 EUVD-2026-330329 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48516 fkie_cve-2026-48516 2026-10-06T07:13:41.304978+00:00

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.

 https://cve.radiocsirt.org/vuln/ghsa-q2h6-ghwm-5qm8 GHSA-q2h6-ghwm-5qm8 — MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings 2026-10-06T07:13:41.305017+00:00

Affected: NuGet: MessagePack

## Summary

`InterfaceLookupFormatter<TKey,TElement>` constructs an internal `Dictionary<TKey, IGrouping<TKey,TElement>>` with the default equality comparer instead of the security-aware comparer supplied by `options.Security.GetEqualityComparer<TKey>()`.

Other hash-based collection formatters use the security-aware comparer when `MessagePackSecurity.UntrustedData` is configured. This formatter omission allows hash-collision CPU denial of service against `ILookup<TKey,TElement>` even when the application has opted into the untrusted-data security posture.

## Impact

Applications are affected when they deserialize untrusted payloads into schemas containing `ILookup<TKey,TElement>` with a key type for which attacker-controlled hash collisions are feasible.

Under the default comparer, many colliding keys can degrade dictionary insertion from amortized constant time to quadratic behavior. A payload of colliding keys can consume CPU for a disproportionate amount of time. This bypasses the mitigation that developers intentionally enabled by using `MessagePackSecurity.UntrustedData`.

## Affected components

- Package: `MessagePack` - API: `InterfaceLookupFormatter<TKey,TElement>.Create` - Data type: `ILookup<TKey,TElement>` - Finding ID: `MESSAGEPACKCSHARP-041`

## Patches

Fixes are prepared and will be released in coordinated patch versions.

Upgrade guidance:

1. Upgrade `MessagePack` to the patched version for your release line. 2. Upgrade companion MessagePack packages in…