Skip to content
OpenAdvisories

Package · NuGet

Nerdbank.MessagePack

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    GHSA-92vj-hp7m-gwcj

    Nerdbank.MessagePack has Inefficient CPU Computation

    ### Impact Applications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many…

    Nerdbank.MessagePack NuGet
  • Medium 5.3
    GHSA-qjvr-435c-5fjh

    Nerdbank.MessagePack has a memory amplification DoS in collection deserialization

    Nerdbank.MessagePack deserializers for many collection-shaped types trusted the element count declared in MessagePack array and map headers when allocating destination storage. A crafted payload could therefore force large arrays, pooled buffers, dictionaries…

    Nerdbank.MessagePack NuGet