Description (CNA)
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| neuecc / MessagePack | affected < 1.9.11; affected >= 2.0.0, < 2.1.90 |
| neuecc / MessagePack.ImmutableCollection | affected < 1.9.11; affected >= 2.0.0, < 2.1.90 |
| neuecc / MessagePack.ReactiveProperty | affected < 1.9.11; affected >= 2.0.0, < 2.1.90 |
| neuecc / MessagePack.UnityShims | affected < 1.9.11; affected >= 2.0.0, < 2.1.90 |
CWE
CWE-121
References
- https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
- https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
- https://github.com/neuecc/MessagePack-CSharp/issues/810
- https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
ADP enrichment
No English description supplied.
- https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
- https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
- https://github.com/neuecc/MessagePack-CSharp/issues/810
- https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007