Technical impact
The flaw exists in the MessagePack-CSharp library’s ExpandoObjectFormatter.Deserialize method, which constructs a System.Dynamic.ExpandoObject by adding map entries one by one. Each Add call triggers a linear scan of the internal array and may cause an array copy; when an attacker supplies a map with many distinct keys, the total work grows quadratically, consuming CPU cycles and memory. This can degrade application responsiveness or cause crashes, thereby compromising availability.
Affected Systems
Binaries from MessagePack-CSharp are affected. Versions earlier than 2.5.301 and 3.1.7 are vulnerable; upgrading to 2.5.301, 3.1.7, or later resolves the issue. No other vendors or products are listed.
Risk and Exploitability
The CVSS score of 6.3 signals moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that active exploitation may be limited or unknown. The attack can be carried out simply by supplying a malicious payload containing a large number of keys to any application that deserializes data with an unpatched version of the library. Privilege escalation is not required, and the exploit path is straightforward. The lack of a KEV listing suggests early detection or low exploitation activity, but the moderate CVSS and the potential for significant resource exhaustion warrant prompt attention.
Github GHSA