Nerdbank.MessagePack Inefficient CPU Computation in ExpandoObjectConverter

Executive brief

Nerdbank.MessagePack is a .NET library used for high-performance data serialization. A vulnerability exists where processing specially crafted untrusted data can cause the application to consume excessive CPU resources. This can lead to a denial-of-service (DoS) condition, making the application slow or unresponsive to legitimate users.

Technical details

The vulnerability is a CWE-1176 (Inefficient CPU Computation) issue within the OptionalConverters.WithExpandoObjectConverter component. When deserializing untrusted data, an attacker can provide a large number of properties for an ExpandoObject. Because the Add method for ExpandoObject is O(n), the overall deserialization process becomes O(n²), allowing for a CPU-exhaustion denial-of-service attack. This can be exploited over the network without authentication if the application processes untrusted MessagePack data using the affected converter. The issue is fixed in version 1.2.4, which introduces a default limit of 128 properties.

Affected products

• AArnott Nerdbank.MessagePack < 1.2.4

Timeline

• 2026-05-18: patched: Fix committed to repository
• 2026-05-29: advisory: GitHub Advisory published

References

• https://api.github.com/users/AArnott
• https://github.com/AArnott
• https://api.github.com/users/AArnott/gists%7B/gist_id%7D
• https://api.github.com/users/AArnott/repos
• https://avatars.githubusercontent.com/u/3548?v=4
• https://api.github.com/users/AArnott/events%7B/privacy%7D