AZL-113039
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113039.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113039
- Upstream
- Published
- 2026-06-22T22:16:48Z
- Modified
- 2026-11-13T06:04:48Z
- Summary
- CVE-2026-48516 affecting package python-msgpack 1.2.3-1
- Details
-
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
- References