https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:15:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330292 EUVD-2026-330292 https://cve.radiocsirt.org/vuln/euvd-2026-330292 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48511 <p>MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary&lt;string, object&gt;.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.</p> <p>MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary&lt;string, object&gt;.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies. For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, but collision-resistant dictionary comparers cannot protect ExpandoObject insertion internals. This vulnerability is fixed in 2.5.301 and 3.1.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48511 https://cve.radiocsirt.org/vuln/ghsa-2x83-8g95-xh59 <p><strong>Affected:</strong> NuGet: MessagePack</p> <p>## Summary</p> <p>`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary&lt;string, object&gt;.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.</p> <p>For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.</p> <p>## Impact</p> <p>Applications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.</p> <p>A hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.</p> <p>This is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`&#39;s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.</p> <p>## Affected components</p> <p>- Package: `MessagePack` - APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver` - Data type: `System.Dynamic.ExpandoObject` - Finding ID: `MESSAGEPACKCSHARP-102`</p> <p>## Patches</p> <p>Fixes are prepared and will be released in coor…</p> <p><strong>Affected:</strong> NuGet: MessagePack</p> <p>## Summary</p> <p>`ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary&lt;string, object&gt;.Add` for each map entry. `ExpandoObject` internally maintains member names in array-like structures, so inserting many distinct keys can require repeated linear scans and array copies.</p> <p>For large attacker-controlled maps, this produces quadratic CPU and allocation behavior. The issue is especially surprising because `ExpandoObjectResolver.Options` is configured with `MessagePackSecurity.UntrustedData`, but collision-resistant dictionary comparers cannot protect `ExpandoObject` insertion internals.</p> <p>## Impact</p> <p>Applications are affected when they deserialize untrusted MessagePack maps into `ExpandoObject` using `ExpandoObjectResolver` or related resolver options.</p> <p>A hostile payload containing many distinct keys can cause CPU exhaustion and allocation churn disproportionate to the input size. This can make a server unresponsive or exhaust memory under concurrent request load.</p> <p>This is not a hash-collision attack against a configurable dictionary comparer. The super-linear behavior comes from `ExpandoObject`&#39;s insertion model, so `MessagePackSecurity.UntrustedData` does not eliminate the cost.</p> <p>## Affected components</p> <p>- Package: `MessagePack` - APIs: `ExpandoObjectFormatter.Deserialize`, `ExpandoObjectResolver` - Data type: `System.Dynamic.ExpandoObject` - Finding ID: `MESSAGEPACKCSHARP-102`</p> <p>## Patches</p> <p>Fixes are prepared and will be released in coor…</p> https://cve.radiocsirt.org/vuln/ghsa-2x83-8g95-xh59