Threats tagged 'ghsa-q2h6-ghwm-5qm8'

MessagePack-CSharp's InterfaceLookupFormatter<TKey,TElement> constructs an internal dictionary using the default equality comparer instead of the security-aware comparer when deserializing ILookup<TKey,TElement>. This omission allows an attacker to craft payloads with colliding keys that degrade dictionary insertion performance, causing a CPU denial of service even when the application opts into untrusted-data security settings. The vulnerability affects versions of MessagePack prior to 2.5.301 and versions 3.0 up to but not including 3.1.7.