https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:37:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196426 EUVD-2026-196426 https://cve.radiocsirt.org/vuln/euvd-2026-196426 https://cve.radiocsirt.org/vuln/fkie_cve-2024-48924 <p>### Impact</p> <p>When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.</p> <p>This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability.</p> <p>### Patches</p> <p>The following steps are required to mitigate this risk.</p> <p>1. Upgrade to a version of the library where a fix is available. 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data.</p> <p>### Workarounds</p> <p>If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows:</p> <p>1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer&lt;T&gt;` method to provide a collision-resistant hash function of your own and avoid calling `base.GetHashCollisionResistantEqualityComparer&lt;T&gt;()`. 3. Configure a `MessagePackSerializerOptions` with an instance of your derived type by calling `WithSecurity` on an existing options object. 4. Use your custom options object for all deserialization operations. This may be by…</p> <p>### Impact</p> <p>When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.</p> <p>This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability.</p> <p>### Patches</p> <p>The following steps are required to mitigate this risk.</p> <p>1. Upgrade to a version of the library where a fix is available. 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data.</p> <p>### Workarounds</p> <p>If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows:</p> <p>1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer&lt;T&gt;` method to provide a collision-resistant hash function of your own and avoid calling `base.GetHashCollisionResistantEqualityComparer&lt;T&gt;()`. 3. Configure a `MessagePackSerializerOptions` with an instance of your derived type by calling `WithSecurity` on an existing options object. 4. Use your custom options object for all deserialization operations. This may be by…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-48924 https://cve.radiocsirt.org/vuln/ghsa-4qm4-8hg2-g2xm <p><strong>Affected:</strong> NuGet: MessagePack</p> <p>### Impact</p> <p>When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.</p> <p>This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability.</p> <p>### Patches</p> <p>The following steps are required to mitigate this risk.</p> <p>1. Upgrade to a version of the library where a fix is available. If upgrading from v1, check out [our migration guide](https://github.com/MessagePack-CSharp/MessagePack-CSharp/blob/master/doc/migration.md). 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data.</p> <p>### Workarounds</p> <p>If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows:</p> <p>1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer&lt;T&gt;` method to provide a collision-resistant hash function of your own and avoid calling `base.GetHashCollisionResistantEqualityComparer&lt;T&gt;()`. 3. Configure a `MessagePackSerializerOptions` with an instance of your derived type…</p> <p><strong>Affected:</strong> NuGet: MessagePack</p> <p>### Impact</p> <p>When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.</p> <p>This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability.</p> <p>### Patches</p> <p>The following steps are required to mitigate this risk.</p> <p>1. Upgrade to a version of the library where a fix is available. If upgrading from v1, check out [our migration guide](https://github.com/MessagePack-CSharp/MessagePack-CSharp/blob/master/doc/migration.md). 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data.</p> <p>### Workarounds</p> <p>If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows:</p> <p>1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer&lt;T&gt;` method to provide a collision-resistant hash function of your own and avoid calling `base.GetHashCollisionResistantEqualityComparer&lt;T&gt;()`. 3. Configure a `MessagePackSerializerOptions` with an instance of your derived type…</p> https://cve.radiocsirt.org/vuln/ghsa-4qm4-8hg2-g2xm