Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TKey, IGrouping<TKey,TElement>> with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer<TKey>(). This formatter omission allows hash-collision CPU denial of service against ILookup<TKey,TElement> even when the application has opted into the untrusted-data security posture This vulnerability is fixed in 2.5.301 and 3.1.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MessagePack-CSharp | MessagePack-CSharp | >= 3.0, < 3.1.7, < 2.5.301 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-msgpack | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | MessagePack | < 2.5.301 | 2.5.301 | GHSA-q2h6-ghwm-5qm8 |
| NuGet | MessagePack | >= 3.0, < 3.1.7 | 3.1.7 | GHSA-q2h6-ghwm-5qm8 |