msgpack5 Streaming Decoder Memory Exhaustion Vulnerability

Executive Summary

This vulnerability affects msgpack5 versions prior to 6.1.0. It involves the reserved MessagePack byte 0xc1 being incorrectly treated as incomplete input instead of invalid input. When 0xc1 starts a stream, the decoder buffers all subsequent data while waiting for bytes that cannot make the value valid, leading to unbounded memory usage.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for processes using msgpack5 versions prior to 6.1.0. Check npm package versions with 'npm list msgpack5' or inspect package.json files. Look for unexpected memory usage spikes in applications using msgpack5, particularly when processing MessagePack data streams.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to exhaust server memory by sending streams starting with 0xc1, causing denial-of-service conditions. The attack requires no privileges or user interaction and is network-based.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by enabling memory exhaustion attacks through crafted MessagePack data. While it does not directly expose or leak data, it could disrupt services handling sensitive information, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). However, the vulnerability itself does not directly affect confidentiality or integrity controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update msgpack5 to version 6.1.0 or later using 'npm update msgpack5'. If updating is not possible, implement input validation to reject MessagePack byte 0xc1 before processing. Add stream byte and time limits to prevent unbounded buffering.

Useful 0 Not Useful 0