Allocation of Resources Without Limits or Throttling Affecting meridian.mediator package, versions [,2.1.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-DOTNET-MERIDIANMEDIATOR-16115267
- published28 Apr 2026
- disclosed16 Apr 2026
- creditUnknown
Introduced: 16 Apr 2026
New CVE NOT AVAILABLE CWE-770 (opens in a new tab)How to fix?
Upgrade Meridian.Mediator to version 2.1.1 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the MappingEngine.TryMapCollectionOntoExisting object through Map(src) call. An attacker can exhaust system resources and cause application downtime by submitting large collection payloads that bypass intended safety caps.
Note:
The vendor disclosed several security gaps in publicly accessible APIs, ranging from Low to High severity. For more details see their Security Advisory.