{"items":[{"id":"NVI-00018284","kind":"vulnerability","title":"Nerdbank.MessagePack has a memory amplification DoS in collection deserialization","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qjvr-435c-5fjh"],"plain_summary":"GitHub lists this reviewed advisory for Nerdbank.MessagePack. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-05f8ce2201a0799a3900efce6b032a95"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-05-29T19:55:11.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-05f8ce2201a0799a3900efce6b032a95"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-05f8ce2201a0799a3900efce6b032a95","url":"https://github.com/advisories/GHSA-qjvr-435c-5fjh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qjvr-435c-5fjh","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:14.635Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-05f8ce2201a0799a3900efce6b032a95"],"technology":"Nerdbank.MessagePack","known_exclusions":[],"conditions_summary":"Nerdbank.MessagePack deserializers for many collection-shaped types trusted the element count declared in MessagePack array and map headers when allocating destination storage. A crafted payload could therefore force large arrays, pooled buffers, dictionaries, or collection instances to be allocated before the deserializer had consumed the corresponding elements.\n\nThe same allocation pattern existed across strongly typed arrays, primitive arrays, mutable and immutable dictionaries, mutable enumerables, span-backed enumerable construction, `JsonNode`, `MessagePackValue`, and the object/dynamic primitive converters.\n\nBecause MessagePack array and map headers carry an attacker-controlled element count, any converter that immediately allocates `count` elements or constructs a collection with capacity `count` can turn a payload that is merely large into a much larger managed heap allocation. The reader's residency checks reduce the most extreme header-only attack shape, but they do not remove the memory amplification: minimal MessagePack elements can be one or two bytes on the wire while the managed representation may require object references, dictionary buckets, entries, array headers","public_affected_ranges":["< 1.1.78"]}],"null_published_at":"2026-11-07T07:07:39.801Z","source_updated_at":"2026-05-29T19:55:11.000Z","source_disclosed_at":"2026-05-29T19:55:09.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:53:14.635Z"}],"next_cursor":null,"snapshot_revision":"42594"}