Threats tagged 'ghsa-w567-gjr2-hm5j'

MessagePack-CSharp's UnsafeBlitFormatterBase<T>.Deserialize method in Unity blit resolvers improperly allocates memory based on an attacker-controlled byte length without validating it against the actual payload size. This can lead to excessive memory allocation and potential out-of-memory exceptions or process termination on memory-constrained platforms when deserializing untrusted data. The vulnerability affects the MessagePack.UnityClient package and specific resolvers prior to patched versions. The issue is mitigated by upgrading to patched versions or avoiding use of vulnerable resolvers with untrusted input.