EUVD-2026-38386
GHSA-v72x-2h86-7f8m
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity because LZ4 compression must be enabled and attacker must reach the deserialization endpoint; availability-only low impact with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
LZ4 decompression in MessagePack for C
prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attackers to force excessive heap memory allocations via crafted Lz4Block or Lz4BlockArray payloads that declare arbitrarily large uncompressed lengths. The library allocates an output buffer sized to the attacker-controlled wire-format length field before performing any validation of the compressed data or the reasonableness of the declared expansion, enabling a classic decompression-bomb denial-of-service. No public exploit has been identified at time of analysis and no CISA KEV listing exists; however, the attack pattern is mechanically straightforward for any application that accepts untrusted MessagePack data with LZ4 compression enabled.
Technical ContextAI
CWE-409 (Improper Handling of Highly Compressed Data, also known as a decompression bomb or data amplification attack) is the root cause class. MessagePack-CSharp (CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:*) is a high-performance binary serialization library for .NET/C
that optionally supports LZ4 compression of message payloads via two extension types: Lz4Block and Lz4BlockArray. The vulnerable code path reads the declared uncompressed length from the wire-format message header and uses it to pre-allocate an output buffer before the LZ4 decompression begins and before any structural validation of the compressed data is performed. Because this length field is fully attacker-controlled and subject to no upper-bound check, a trivially small compressed payload can assert a multi-gigabyte uncompressed size, forcing the runtime to attempt a correspondingly large heap allocation. This is a well-understood data amplification primitive; the novelty here is its presence in a widely-used .NET serialization library.
RemediationAI
Upgrade to MessagePack-CSharp 2.5.301 (v2 branch) or 3.1.7 (v3 branch), the vendor-released patches confirmed by GitHub Security Advisory GHSA-v72x-2h86-7f8m, which add validation of declared uncompressed lengths prior to buffer allocation. If an immediate upgrade is not feasible, the most effective compensating control is to disable LZ4 compression in deserialization options - by configuring MessagePackSerializerOptions without LZ4 compression, the Lz4Block and Lz4BlockArray code paths are never exercised; the trade-off is increased payload sizes and bandwidth consumption. Where LZ4 must remain enabled, adding a hard upper bound on incoming MessagePack payload sizes at the network gateway or application middleware layer limits the maximum memory allocatable per request but does not eliminate the root cause. The vendor advisory is the authoritative remediation reference: https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-v72x-2h86-7f8m.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticat
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today