Threats Tagged 'ghsa-cxmj-83gh-fp49'

MessagePack-CSharp contains a vulnerability in its multi-dimensional array formatters where dimension lengths are read from untrusted payloads and used to allocate arrays before validating that the total element count matches the encoded data. This can lead to excessive memory allocation and potential out-of-memory conditions when deserializing untrusted data into multi-dimensional arrays such as T[,], T[,,], or T[,,,]. The issue affects versions prior to 2.5.301 and versions 3.0 up to but not including 3.1.7. Fixes are prepared but not yet released. Until patched, users should avoid deserializing untrusted payloads into multi-dimensional arrays and prefer safer data shapes.