Description
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
neuecc MessagePack
< 1.9.11affected>= 2.0.0, < 2.1.90affected
neuecc MessagePack.ImmutableCollection
< 1.9.11affected>= 2.0.0, < 2.1.90affected
neuecc MessagePack.ReactiveProperty
< 1.9.11affected>= 2.0.0, < 2.1.90affected
neuecc MessagePack.UnityShims
< 1.9.11affected>= 2.0.0, < 2.1.90affected
References
- https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf ↗
- https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02 ↗
- https://github.com/neuecc/MessagePack-CSharp/issues/810 ↗
- https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007 ↗