Executive Summary

This vulnerability exists in MessagePack for C#, specifically in versions prior to 2.5.301 and 3.1.7. The issue is in the UnsafeBlitFormatterBase<T>.Deserialize method, which reads a byteLength value controlled by an attacker from an extension payload. It then allocates an array based on this byteLength without properly validating it against the extension header length or the remaining payload bytes.

Although the outer extension header is bounded by the available input, this bound is not used to constrain the inner byteLength before allocation. As a result, an attacker can send a very small payload that requests a very large array allocation, potentially causing resource exhaustion or other issues.

This vulnerability has been fixed in versions 2.5.301 and 3.1.7.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to control the size of an array allocation during deserialization, which can lead to excessive memory allocation.

This can cause denial of service (DoS) conditions by exhausting system memory or causing application crashes.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0