{"id":"GHSA-92vj-hp7m-gwcj","aliases":[],"status":"published","title":"Nerdbank.MessagePack has Inefficient CPU Computation","description":"### Impact\n\nApplications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an `ExpandoObject`, whose `Add` method is implemented as an `O(n)` algorithm.\n\n### Patches\n\nUpdate to a patched version.\n\nIf a project's `ExpandoObject` data requires more than 128 properties, the default limit should be changed:\n\n```cs\nthis.Serializer = this.Serializer with\n{\n\tStartingContext = this.Serializer.StartingContext with\n\t{\n\t\tSecurity = this.Serializer.StartingContext.Security with\n\t\t{\n\t\t\tExpandoObjectMaxPropertyCount = 256, // Set this to whatever limit is required by your application\n\t\t},\n\t},\n};\n```\n\n### Workarounds\n\nAvoid the non-default `WithExpandoObjectConverter` extension method when deserializing untrusted data.\nIf deserializing untrusted data into an `ExpandoObject` is required, developers should write a custom converter for their project that limits the number of properties allowed before initializing the object.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1176"],"published":"2026-05-29T20:02:59Z","modified":"2026-05-29T20:15:14Z","fixes":[{"ecosystem":"NuGet","package":"Nerdbank.MessagePack","fixed_in":["1.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Nerdbank.MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Nerdbank.MessagePack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}],"versions":["0.1.705-alpha-gad428877b7","0.1.734-alpha-g09268fd45c","0.10.2-rc","0.10.7-rc","0.2.108-alpha","0.2.2-alpha","0.2.34-alpha","0.2.52-alpha","0.2.82-alpha","0.3.120-beta","0.3.151-beta","0.3.161-beta","0.3.2-alpha","0.3.27-alpha","0.3.38-beta","0.4.5-beta","0.5.1-beta","0.5.37-beta","0.5.57-beta","0.5.72-beta","0.5.80-beta","0.6.1-beta","0.6.27-beta","0.6.7-beta","0.7.1-beta","0.8.1-rc","0.8.102-rc","0.8.111-rc","0.8.128-rc","0.8.131-rc","0.8.30-rc","0.8.46-rc","0.8.54-rc","0.8.67-rc","0.8.82-rc","0.8.90-rc","0.8.92-rc","0.9.12-rc","0.9.14-rc","0.9.23-rc","0.9.26-rc","0.9.35-rc","1.0.11","1.0.2","1.0.40","1.0.43","1.1.25","1.1.62","1.1.78"]}],"references":[{"url":"https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-92vj-hp7m-gwcj","tags":["web"]},{"url":"https://github.com/AArnott/Nerdbank.MessagePack/commit/c5a239e4f20c38548de44c4dd2a782efd5e2547c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-92vj-hp7m-gwcj"},{"url":"https://github.com/AArnott/Nerdbank.MessagePack","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-92vj-hp7m-gwcj","title":"Nerdbank.MessagePack has Inefficient CPU Computation","description":"### Impact\n\nApplications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an `ExpandoObject`, whose `Add` method is implemented as an `O(n)` algorithm.\n\n### Patches\n\nUpdate to a patched version.\n\nIf a project's `ExpandoObject` data requires more than 128 properties, the default limit should be changed:\n\n```cs\nthis.Serializer = this.Serializer with\n{\n\tStartingContext = this.Serializer.StartingContext with\n\t{\n\t\tSecurity = this.Serializer.StartingContext.Security with\n\t\t{\n\t\t\tExpandoObjectMaxPropertyCount = 256, // Set this to whatever limit is required by your application\n\t\t},\n\t},\n};\n```\n\n### Workarounds\n\nAvoid the non-default `WithExpandoObjectConverter` extension method when deserializing untrusted data.\nIf deserializing untrusted data into an `ExpandoObject` is required, developers should write a custom converter for their project that limits the number of properties allowed before initializing the object.","status":"published","published":"2026-05-29T20:02:59Z","modified":"2026-05-29T20:02:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1176"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"osv":[{"id":"GHSA-92vj-hp7m-gwcj","title":"Nerdbank.MessagePack has Inefficient CPU Computation","description":"### Impact\n\nApplications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an `ExpandoObject`, whose `Add` method is implemented as an `O(n)` algorithm.\n\n### Patches\n\nUpdate to a patched version.\n\nIf a project's `ExpandoObject` data requires more than 128 properties, the default limit should be changed:\n\n```cs\nthis.Serializer = this.Serializer with\n{\n\tStartingContext = this.Serializer.StartingContext with\n\t{\n\t\tSecurity = this.Serializer.StartingContext.Security with\n\t\t{\n\t\t\tExpandoObjectMaxPropertyCount = 256, // Set this to whatever limit is required by your application\n\t\t},\n\t},\n};\n```\n\n### Workarounds\n\nAvoid the non-default `WithExpandoObjectConverter` extension method when deserializing untrusted data.\nIf deserializing untrusted data into an `ExpandoObject` is required, developers should write a custom converter for their project that limits the number of properties allowed before initializing the object.","status":"published","published":"2026-05-29T20:02:59Z","modified":"2026-05-29T20:15:14.889386258Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1176"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}