Executive Summary

This vulnerability exists in MessagePack for C#, a serializer for C#. Before versions 2.5.301 and 3.1.7, when decompressing Lz4Block or Lz4BlockArray payloads, the software reads the declared uncompressed length from the data stream and allocates memory buffers based on that length without first validating the compressed data or checking if the declared size is reasonable.

An attacker can exploit this by sending a small compressed payload that falsely claims a very large uncompressed size, causing the program to allocate a large amount of memory unnecessarily before decompression begins.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to excessive memory allocation, which may cause denial of service (DoS) conditions by exhausting system memory resources.

This can degrade system performance or cause the application to crash, potentially disrupting services that rely on MessagePack for C#.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0