The InterfaceLookupFormatter<TKey,TElement> in MessagePack-CSharp creates an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer rather than the security-aware comparer provided by options.Security.GetEqualityComparer<TKey>(). This contrasts with other hash-based collection formatters that correctly use the security-aware comparer when MessagePackSecurity.UntrustedData is enabled. As a result, deserializing untrusted payloads containing ILookup<TKey,TElement> with attacker-controlled colliding keys can cause hash collision-based CPU denial of service by degrading dictionary insertion performance from amortized constant time to quadratic time. Fixes are prepared to ensure the internal dictionary uses the security-aware comparer, aligning with sibling formatters.

Applications deserializing untrusted data into ILookup<TKey,TElement> types with vulnerable MessagePack versions are susceptible to CPU denial of service via hash collision attacks. This bypasses the intended security posture of MessagePackSecurity.UntrustedData, potentially causing significant CPU resource consumption and degraded application performance. The impact is limited to scenarios where attacker-controlled keys can cause collisions under the default comparer.

A patch is prepared and will be released in coordinated versions of MessagePack. Users should upgrade to the patched versions once available. Until then, avoid exposing ILookup<TKey,TElement> in data transfer objects deserializing untrusted data. Alternatively, use collection types that already employ the security-aware comparer or implement validation and size caps on collections at the transport boundary to mitigate potential denial of service.