Untrusted data can lead to DoS attack in MessagePack for C# and Unity
Priority LOW 32CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-121 and the CVSS impact.
Summary
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Why it matters now
EPSS 0.01578 75th percentileScored 2026-11-07
Fix Fixed MessagePack (neuecc): 1.9.11, 2.1.90MessagePack.ImmutableCollection (neuecc): 1.9.11, 2.1.90+7 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| neuecc | MessagePack | before 1.9.11; 2.0.0 to before 2.1.90 | 1.9.11, 2.1.90 | Patch available | CNA |
| neuecc | MessagePack.ImmutableCollection | before 1.9.11; 2.0.0 to before 2.1.90 | 1.9.11, 2.1.90 | Patch available | CNA |
| neuecc | MessagePack.ReactiveProperty | before 1.9.11; 2.0.0 to before 2.1.90 | 1.9.11, 2.1.90 | Patch available | CNA |
| neuecc | MessagePack.UnityShims | before 1.9.11; 2.0.0 to before 2.1.90 | 1.9.11, 2.1.90 | Patch available | CNA |
| — | MessagePack (NuGet) | before 1.9.11 | 1.9.11 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack (NuGet) | 2.0.0 to before 2.1.90 | 2.1.90 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.ImmutableCollection (NuGet) | before 1.9.11 | 1.9.11 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.ImmutableCollection (NuGet) | 2.0.0 to before 2.1.90 | 2.1.90 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.ReactiveProperty (NuGet) | before 1.9.11 | 1.9.11 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.ReactiveProperty (NuGet) | 2.0.0 to before 2.1.90 | 2.1.90 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.UnityShims (NuGet) | before 1.9.11 | 1.9.11 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.UnityShims (NuGet) | 2.0.0 to before 2.1.90 | 2.1.90 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.Unity (NuGet) | before 1.9.11 | 1.9.11 | Patch available | GHSA-7q36-4xx7-xcxf |
| — | MessagePack.Unity (NuGet) | 2.0.0 to before 2.1.90 | 2.1.90 | Patch available | GHSA-7q36-4xx7-xcxf |
- MessagePack Vendorneuecc Affected before 1.9.11; 2.0.0 to before 2.1.90 Fixed in 1.9.11, 2.1.90 Patch available CNA
- MessagePack.ImmutableCollection Vendorneuecc Affected before 1.9.11; 2.0.0 to before 2.1.90 Fixed in 1.9.11, 2.1.90 Patch available CNA
- MessagePack.ReactiveProperty Vendorneuecc Affected before 1.9.11; 2.0.0 to before 2.1.90 Fixed in 1.9.11, 2.1.90 Patch available CNA
- MessagePack.UnityShims Vendorneuecc Affected before 1.9.11; 2.0.0 to before 2.1.90 Fixed in 1.9.11, 2.1.90 Patch available CNA
- MessagePack (NuGet) Vendor— Affected before 1.9.11 Fixed in 1.9.11 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack (NuGet) Vendor— Affected 2.0.0 to before 2.1.90 Fixed in 2.1.90 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.ImmutableCollection (NuGet) Vendor— Affected before 1.9.11 Fixed in 1.9.11 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.ImmutableCollection (NuGet) Vendor— Affected 2.0.0 to before 2.1.90 Fixed in 2.1.90 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.ReactiveProperty (NuGet) Vendor— Affected before 1.9.11 Fixed in 1.9.11 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.ReactiveProperty (NuGet) Vendor— Affected 2.0.0 to before 2.1.90 Fixed in 2.1.90 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.UnityShims (NuGet) Vendor— Affected before 1.9.11 Fixed in 1.9.11 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.UnityShims (NuGet) Vendor— Affected 2.0.0 to before 2.1.90 Fixed in 2.1.90 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.Unity (NuGet) Vendor— Affected before 1.9.11 Fixed in 1.9.11 Patch available GHSA-7q36-4xx7-xcxf
- MessagePack.Unity (NuGet) Vendor— Affected 2.0.0 to before 2.1.90 Fixed in 2.1.90 Patch available GHSA-7q36-4xx7-xcxf
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* | before 1.9.3; 2.0.323 to before 2.1.80 | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.94:alpha:*:*:*:c\#:*:* | 2.0.94 alpha | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.110:alpha:*:*:*:c\#:*:* | 2.0.110 alpha | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.119:beta:*:*:*:c\#:*:* | 2.0.119 beta | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.123:beta:*:*:*:c\#:*:* | 2.0.123 beta | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.204:beta:*:*:*:c\#:*:* | 2.0.204 beta | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.270:rc:*:*:*:c\#:*:* | 2.0.270 rc | Vulnerable | MessagePack-CSharp |
| cpe:2.3:a:messagepack:messagepack:2.0.299:rc:*:*:*:c\#:*:* | 2.0.299 rc | Vulnerable | MessagePack-CSharp |
- cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* Versions before 1.9.3; 2.0.323 to before 2.1.80 Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.94:alpha:*:*:*:c\#:*:* Versions 2.0.94 alpha Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.110:alpha:*:*:*:c\#:*:* Versions 2.0.110 alpha Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.119:beta:*:*:*:c\#:*:* Versions 2.0.119 beta Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.123:beta:*:*:*:c\#:*:* Versions 2.0.123 beta Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.204:beta:*:*:*:c\#:*:* Versions 2.0.204 beta Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.270:rc:*:*:*:c\#:*:* Versions 2.0.270 rc Vulnerable ·MessagePack-CSharp
- cpe:2.3:a:messagepack:messagepack:2.0.299:rc:*:*:*:c\#:*:* Versions 2.0.299 rc Vulnerable ·MessagePack-CSharp
Remediation
- Fix · CNA MessagePack (neuecc) Fixed in 1.9.11, 2.1.90
- Fix · CNA MessagePack.ImmutableCollection (neuecc) Fixed in 1.9.11, 2.1.90
- Fix · CNA MessagePack.ReactiveProperty (neuecc) Fixed in 1.9.11, 2.1.90
- Fix · CNA MessagePack.UnityShims (neuecc) Fixed in 1.9.11, 2.1.90
- Fix · GHSA-7q36-4xx7-xcxf MessagePack (NuGet) Fixed in 1.9.11 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack (NuGet) Fixed in 2.1.90 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.ImmutableCollection (NuGet) Fixed in 1.9.11 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.ImmutableCollection (NuGet) Fixed in 2.1.90 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.ReactiveProperty (NuGet) Fixed in 1.9.11 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.ReactiveProperty (NuGet) Fixed in 2.1.90 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.UnityShims (NuGet) Fixed in 1.9.11 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.UnityShims (NuGet) Fixed in 2.1.90 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.Unity (NuGet) Fixed in 1.9.11 Advisory →
- Fix · GHSA-7q36-4xx7-xcxf MessagePack.Unity (NuGet) Fixed in 2.1.90 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5234
- 2026-10-03 Alias added: GHSA-7q36-4xx7-xcxf
References
Advisory 2
Other 5
- https://github.com/neuecc/MessagePack-CSharp/issues/810
- https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
- https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
- https://github.com/aspnet/Announcements/issues/405
- https://github.com/MessagePack-CSharp/MessagePack-CSharp
More MessagePack-CSharp Messagepack vulnerabilities
- TI-2026-35549 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVSS 3.1HIGH 8.2
- TI-2026-35866 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVSS 3.1HIGH 7.5
- TI-2026-35873 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVSS 4.0MEDIUM 6.3
- TI-2026-35863 Out-of-bounds read in MessagePack-CSharp CVSS 4.0HIGH 8.2
- TI-2026-35877 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVSS 4.0MEDIUM 6.3
- TI-2026-35876 MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings CVSS 4.0MEDIUM 6.3
Sources
- CVE-2020-5234 · CVE Program
- CVE-2020-5234 · NVD
- FIRST EPSS
- GHSA-7q36-4xx7-xcxf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences