# Nerdbank.MessagePack Inefficient CPU Computation in ExpandoObjectConverter

Source: https://junglewise.ai/threats/nerdbank-messagepack-inefficient-cpu-computation-in-4348932f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2026-05-29

Nerdbank.MessagePack is a .NET library used for high-performance data serialization. A vulnerability exists where processing specially crafted untrusted data can cause the application to consume excessive CPU resources. This can lead to a denial-of-service (DoS) condition, making the application slow or unresponsive to legitimate users.

Technologies: [Andrew Arnott Nerdbank.MessagePack](https://junglewise.ai/threats/technologies/nerdbank-messagepack). Vendors: [Andrew Arnott](https://junglewise.ai/threats/vendors/andrew-arnott).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 29 May 2026.

**Which products and versions are affected?** Andrew Arnott Nerdbank.MessagePack < 1.2.4.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-18: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Andrew Arnott Nerdbank.MessagePack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CWE-1176 (Inefficient CPU Computation) issue within the OptionalConverters.WithExpandoObjectConverter component. When deserializing untrusted data, an attacker can provide a large number of properties for an ExpandoObject. Because the Add method for ExpandoObject is O(n), the overall deserialization process becomes O(n²), allowing for a CPU-exhaustion denial-of-service attack. This can be exploited over the network without authentication if the application processes untrusted MessagePack data using the affected converter. The issue is fixed in version 1.2.4, which introduces a default limit of 128 properties.

## Affected products

- AArnott Nerdbank.MessagePack < 1.2.4

## Timeline

- 2026-05-18: patched: Fix committed to repository
- 2026-05-29: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [Nerdbank.MessagePack memory amplification DoS in collection deserialization](https://junglewise.ai/threats/nerdbank-messagepack-memory-amplification-dos-in-collection-9ee7fe7f)
- [AArnott Nerdbank.MessagePack stack overflow in DateTime decoding](https://junglewise.ai/threats/cve-2026-44375-aarnott-nerdbank-messagepack-stack-overflow-in-datetime-decoding)