Nerdbank.MessagePack memory amplification DoS in collection deserialization

Executive brief

Nerdbank.MessagePack is a library used to serialize and deserialize data for high-performance communication in .NET applications. A vulnerability in how it handles collections (like lists and dictionaries) allows an attacker to send a specially crafted message that forces the application to allocate massive amounts of memory. This can lead to the application slowing down significantly or crashing entirely due to memory exhaustion, disrupting service availability.

Technical details

The vulnerability is a memory amplification DoS caused by untrusted input in collection deserializers. Multiple converters (including ArrayConverter, MutableDictionaryConverter, and JsonNodeConverter) trust the element count declared in MessagePack array and map headers to pre-allocate destination storage or rent buffers before consuming the actual elements. An attacker can provide a small payload (e.g., 1-2 bytes per element) that triggers a much larger managed heap allocation (e.g., 8 bytes per reference plus overhead). This can be exploited via any network endpoint (ASP.NET Core, SignalR, RPC) that accepts untrusted MessagePack data. The issue is fixed in version 1.1.78 by limiting pre-allocation and growing collections as data is encountered.

Affected products

• AArnott Nerdbank.MessagePack < 1.1.78

Timeline

• 2026-05-18: disclosed: Initial disclosure date
• 2026-05-29: advisory: Last updated date
• 2026-05-29: patched: Version 1.1.78 released

References

• https://api.github.com/users/svenclaesson
• https://github.com/svenclaesson
• https://api.github.com/users/svenclaesson/gists%7B/gist_id%7D
• https://api.github.com/users/svenclaesson/repos
• https://avatars.githubusercontent.com/u/2105609?v=4
• https://api.github.com/users/svenclaesson/events%7B/privacy%7D