EUVD-2026-36467

fkie_cve-2020-5234

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

GHSA-7q36-4xx7-xcxf — Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack

Affected: NuGet: MessagePack, NuGet: MessagePack.ImmutableCollection, NuGet: MessagePack.ReactiveProperty, NuGet: MessagePack.UnityShims, NuGet: MessagePack.Unity

### Impact

When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors:

1. hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized. 1. stack overflow - leading to the deserializing process crashing.

### Patches

The following steps are required to mitigate this risk.

1. Upgrade to a version of the library where a fix is available 1. Add code to your application to put MessagePack into the defensive `UntrustedData` mode. 1. Identify all MessagePack extensions that implement `IMessagePackFormatter<T>` implementations that do not ship with the MessagePack library to include the security mitigations. This includes those acquired from 3rd party packages and classes included directly into your project. Any AOT formatters generated with the MPC tool must be regenerated with the patched version of mpc. 1. Review your messagepack-serializable data structures for hash-based collections that use custom or unusual types for the hashed key. See below for details on handling such situations.

Review the `MessagePackSecurity` class to tweak any settings as necessary to strike the right balance between performance, functionality, and security.

Specialized `IEqualityComparer<T>` implementations provide the hash collision resistance. Each type of hashed key may require a specialized implementation of its own. The patched MessagePack library…

Most recent entries from all

EUVD-2026-36467

fkie_cve-2020-5234

GHSA-7q36-4xx7-xcxf — Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack

gsd-2020-5234