Aarnott

**Name of the Vulnerable Software and Affected Versions** MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7 **Description** The `MessagePackReader.TrySkip()` function recursively descends into nested arrays and maps without incrementing the reader depth or triggering configured depth checks. This behavior bypasses `MessagePackSecurity.MaximumObjectGraphDepth`, which is the mechanism designed to protect against deeply nested object graphs. Because many generated and dynamic formatters utilize `reader.Skip()` when encountering unknown map keys, unknown array members, ignored fields, or data intended for forward compatibility, a deeply nested value in these positions can lead to unbounded recursion and an uncatchable StackOverflowException. **Recommendations** Update to version 2.5.301. Update to version 3.1.7.

**Name of the Vulnerable Software and Affected Versions** MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7 **Description** When decompressing Lz4Block or Lz4BlockArray payloads, the software reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating the compressed data or ensuring the declared expansion is reasonable. This allows a small payload to claim an excessively large uncompressed length, forcing a large memory allocation before LZ4 decoding begins. **Recommendations** Update to version 2.5.301. Update to version 3.1.7.

**Name of the Vulnerable Software and Affected Versions** MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7 **Description** The `InterfaceLookupFormatter<TKey,TElement>` constructs an internal `Dictionary<TKey, IGrouping<TKey,TElement>>` using the default equality comparer instead of the security-aware comparer provided by `options.Security.GetEqualityComparer<TKey>()`. This omission enables a hash-collision CPU denial of service against `ILookup<TKey,TElement>`, even in applications configured with an untrusted-data security posture. **Recommendations** Update to version 2.5.301. Update to version 3.1.7.

**Name of the Vulnerable Software and Affected Versions** MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7 **Description** Typeless deserialization in MessagePack-CSharp uses `MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type)` to prevent the deserialization of dangerous types. However, the default implementation only verifies the outer type name and fails to recursively inspect generic type arguments or array element types. This allows a blocked type to bypass the safety check if it is wrapped within a generic type or an array, enabling the formatter machinery to materialize formatters for the restricted inner type. **Recommendations** Update MessagePack for C# to version 2.5.301 or later. Update MessagePack for C# to version 3.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nerdbank.MessagePack versions prior to 1.1.62 **Description** An uncontrolled stack allocation issue exists in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, leading the reader to allocate an attacker-controlled number of bytes on the stack. This occurs because the `tokenSize` is derived from the extension length before validating that it matches legal MessagePack timestamp sizes (4, 8, or 12 bytes). When the buffer is incomplete, this unvalidated size is used in a `stackalloc` operation, triggering a `StackOverflowException` that terminates the process and results in a denial of service. This affects applications deserializing MessagePack data from untrusted sources where the target type contains a `DateTime` value. **Recommendations** Update to version 1.1.62. Avoid deserializing untrusted MessagePack payloads into type graphs containing `DateTime` fields or properties. Pre-validate MessagePack extension headers and reject timestamp extensions with lengths other than 4, 8, or 12 bytes. Reject or filter extension type `-1` timestamp values from untrusted input. Run deserialization of untrusted payloads in an isolated process that can be safely restarted. Restrict MessagePack deserialization to trusted producers.

**Name of the Vulnerable Software and Affected Versions** MessagePack-CSharp versions prior to 2.5.187 and 3.0.214 **Description** The vulnerability occurs when the library is used to deserialize messagepack data from an untrusted source, leading to a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions. This results in large CPU consumption disproportionate to the size of the data being deserialized. The issue is similar to a prior advisory, which provided an inadequate fix for the hash collision part of the vulnerability. **Recommendations** To mitigate this risk, upgrade to a version of the library where a fix is available. If upgrading from v1, check out the migration guide. Review the steps in the previous advisory to ensure the application is configured for untrusted data. If upgrading MessagePack to a patched version is not an option, apply a manual workaround by declaring a class that derives from `MessagePackSecurity`, overriding the `GetHashCollisionResistantEqualityComparer` method to provide a collision-resistant hash function, and configuring `MessagePackSerializerOptions` with an instance of the derived type. Use the custom options object for all deserialization operations.