Inefficient CPU Computation Affecting nerdbank.messagepack package, versions [,1.2.4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-NERDBANKMESSAGEPACK-17111651
- published31 May 2026
- disclosed29 May 2026
- creditUnknown
Introduced: 29 May 2026
New CVE NOT AVAILABLE CWE-1176 (opens in a new tab)How to fix?
Upgrade Nerdbank.MessagePack to version 1.2.4 or higher.
Overview
Nerdbank.MessagePack is an A modern, fast and NativeAOT-compatible MessagePack serialization library
Affected versions of this package are vulnerable to Inefficient CPU Computation in the WithExpandoObjectConverter. An attacker can cause excessive CPU consumption by deserializing specially crafted data containing a large number of properties, which exploits an inefficient O(n²) algorithm in the handling of ExpandoObject properties.
Workaround
This vulnerability can be mitigated by avoiding the use of the non-default WithExpandoObjectConverter extension method when deserializing untrusted data, or by implementing a custom converter that limits the number of properties allowed before initializing the object.