Executive Summary

This vulnerability exists in MessagePack for C#, a serializer library. Before versions 2.5.301 and 3.1.7, the runtime-generated union deserializers created by DynamicUnionResolver did not properly enforce maximum object graph depth during recursive deserialization. Specifically, they failed to call MessagePackSecurity.DepthStep(ref reader) and did not decrement reader.Depth around recursive deserialization and skip paths. As a result, union deserialization could bypass the depth checks that protect against excessively deep or recursive data structures. Additionally, when encountering unknown union keys, the deserializer would call reader.Skip() on attacker-controlled data without the necessary depth step, further bypassing protections. This flaw could allow attackers to exploit the deserialization process in ways that were not properly constrained.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to improper enforcement of maximum object graph depth during deserialization, potentially allowing an attacker to craft malicious data that causes excessive resource consumption or unexpected behavior in applications using the affected MessagePack for C# versions. This could result in denial of service or other impacts related to processing attacker-controlled data without proper depth checks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue with runtime-generated union deserializers not enforcing maximum object graph depth has been fixed.

Useful 0 Not Useful 0