EUVD-2026-38385
GHSA-2x83-8g95-xh59
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the requirement that target explicitly uses ExpandoObjectFormatter; PR:N since no auth is needed once the endpoint is reachable; A:L for limited, non-total availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
MessagePack for C
is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.
AnalysisAI
Quadratic CPU and memory allocation behavior in MessagePack-CSharp's ExpandoObjectFormatter enables remote unauthenticated attackers to degrade or deny service by submitting attacker-controlled MessagePack maps containing many distinct keys. Affected are all releases prior to 2.5.301 (2.x branch) and 3.1.7 (3.x branch). No public exploit code has been identified at time of analysis, and no CISA KEV listing was referenced in available intelligence.
Technical ContextAI
MessagePack-CSharp (CPE: cpe:2.3:a:messagepack-csharp:messagepack-csharp:*:*:*:*:*:*:*:*) is a widely-used high-performance binary serialization library for C
and .NET, also popular in Unity game development. The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity). The vulnerable path is ExpandoObjectFormatter.Deserialize, which populates System.Dynamic.ExpandoObject by calling IDictionary<string, object>.Add for each deserialized map entry. ExpandoObject internally represents member names in array-like structures rather than a hash table, meaning each insertion triggers a linear scan of existing keys and potential array copies. Inserting n distinct keys therefore requires O(n) work per step, producing O(n²) total CPU and allocation cost. The advisory specifically calls out that ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData - a setting intended to enable collision-resistant dictionary comparers - but this protection is applied to dictionary lookup structures, not to ExpandoObject's internal array management. The quadratic insertion path is therefore entirely unmitigated even when the developer believes they have hardened the deserializer against untrusted input.
RemediationAI
Upgrade to MessagePack-CSharp 2.5.301 (for 2.x users) or 3.1.7 (for 3.x users), as confirmed by the vendor advisory at https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-2x83-8g95-xh59. If immediate patching is blocked, apply a maximum payload size limit or maximum map key-count restriction at the network boundary or middleware layer (e.g., in ASP.NET Core request body size limits or an API gateway policy), which directly caps the worst-case O(n²) behavior; this is a practical short-term control but does not eliminate the vulnerability. A stronger architectural workaround is to stop using ExpandoObjectFormatter and ExpandoObjectResolver for untrusted data and switch to concrete, strongly-typed MessagePack deserializers, which do not use ExpandoObject internals and are unaffected; this requires schema-aware code changes but removes the vulnerable code path entirely. Avoid relying solely on MessagePackSecurity.UntrustedData as a defense - the advisory confirms it does not protect ExpandoObject insertion.
More in Messagepack Csharp
View allDenial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to terminate host pr
Denial of service in MessagePack for C# versions prior to 2.5.301 and 3.1.7 allows remote attackers to crash application
Typeless deserialization in MessagePack-CSharp allows blocked types to be instantiated by wrapping them inside arrays or
Insecure default initialization in MessagePack for C#'s ASP.NET Core MVC formatter exposes .NET web applications to hash
LZ4 decompression in MessagePack for C# prior to versions 2.5.301 (v2 branch) and 3.1.7 (v3 branch) allows remote attack
Uncontrolled recursion in MessagePack-CSharp's JSON conversion helpers allows remote attackers to crash .NET host proces
Uncontrolled recursion in MessagePack for C# allows network-reachable attackers to crash applications by submitting deep
Unchecked large-array allocation in MessagePack for C# exposes any .NET application deserializing untrusted MessagePack
Heap exhaustion via crafted multi-dimensional array payloads in MessagePack-CSharp affects all v2.x releases before 2.5.
CPU denial of service in MessagePack for C# affects applications deserializing ILookup<TKey,TElement> types from untrust
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today