Asymmetric Resource Consumption (Amplification) Affecting nerdbank.messagepack package, versions [,1.1.78)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-NERDBANKMESSAGEPACK-17111585
- published31 May 2026
- disclosed29 May 2026
- creditSven Claesson
Introduced: 29 May 2026
New CVE NOT AVAILABLE CWE-405 (opens in a new tab)How to fix?
Upgrade Nerdbank.MessagePack to version 1.1.78 or higher.
Overview
Nerdbank.MessagePack is an A modern, fast and NativeAOT-compatible MessagePack serialization library
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the deserialization of collection-shaped types, where the element count from MessagePack array and map headers is trusted for allocating destination storage. An attacker can exhaust system memory or degrade service availability by submitting crafted MessagePack payloads with large declared element counts, causing excessive managed heap allocations before the actual elements are processed.