Technical impact
The MessagePack‑CSharp library uses a constructor that defaults the MessagePackInputFormatter to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. This insecure default allows an attacker to send specially crafted MessagePack payloads that trigger hash‑collision attacks against dictionary‑like model properties, consuming CPU resources and potentially leading to denial of service.
Affected Systems
Applications built with MessagePack‑CSharp versions prior to 2.5.301 and 3.1.7 that employ the default MessagePackInputFormatter in an ASP.NET Core MVC context are affected. The vulnerability is specific to the vendor and product MessagePack‑CSharp:MessagePack‑CSharp.
Risk and Exploitability
The CVSS score of 6.3 indicates a medium risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through HTTP request bodies that are processed by the vulnerable formatter. An attacker can exploit this by sending a malicious MessagePack payload to cause repeated hash collisions in the deserialization process, leading to high CPU consumption and a denial of service.
Github GHSA