Executive brief
MessagePack-CSharp is a library used to serialize and deserialize data for efficient communication between applications. A vulnerability in its LZ4 compression handling allows an attacker to send a specially crafted message that claims to be very large when decompressed. This causes the application to attempt to allocate massive amounts of memory, potentially leading to system crashes, service outages, or severe performance degradation.
Technical details
A resource exhaustion vulnerability exists in MessagePack-CSharp's LZ4 decompression logic (Lz4Block and Lz4BlockArray). The library reads the declared uncompressed length from the incoming payload and allocates an output buffer based on this value before validating the data or checking if the expansion ratio is reasonable. An attacker can provide a small payload with a large declared length to trigger an OutOfMemoryException or process termination. This affects the MessagePackSerializer when LZ4 compression modes are enabled. Patches are available in versions 2.5.301 and 3.1.7, which introduce caps on decompressed sizes.
Affected products
- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory reviewed and updated