Executive Summary

This vulnerability exists in MessagePack for C#, specifically in versions prior to 2.5.301 and 3.1.7. The ExpandoObjectFormatter.Deserialize method populates a System.Dynamic.ExpandoObject by adding each map entry using IDictionary<string, object>.Add. Internally, ExpandoObject maintains member names in array-like structures, so inserting many distinct keys causes repeated linear scans and array copies. When processing large attacker-controlled maps, this results in quadratic CPU and memory allocation behavior, leading to performance degradation.

The issue is notable because even though ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, which uses collision-resistant dictionary comparers, these cannot protect against the internal insertion inefficiencies of ExpandoObject.

This vulnerability was fixed in versions 2.5.301 and 3.1.7 of MessagePack for C#.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant performance degradation when deserializing large attacker-controlled maps using MessagePack for C#. The quadratic CPU and memory allocation behavior can cause excessive resource consumption, potentially leading to denial of service (DoS) conditions where the application becomes slow or unresponsive.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0