GHSA-fx6j-x9m5-vmrf

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. In NES for .NET 6, ASP.NET Core's SignalR MessagePack hub protocol depends on the MessagePack NuGet package, and HeroDevs moves that dependency forward when the library publishes security fixes.

A denial of service vulnerability (GHSA-fx6j-x9m5-vmrf) has been identified in the AssemblyNameVersionSelectorRegex of MessagePack-CSharp, which allows a remote attacker to tie up threads for minutes with a crafted type name when an application deserializes untrusted data with AllowAssemblyVersionMismatch enabled.

Per CWE-1333: Inefficient Regular Expression Complexity, the weakness is a product using a regular expression with an inefficient, possibly exponential, worst-case computational complexity that consumes excessive CPU cycles.

This issue affects NES for .NET 6.0.42 through 6.0.46, whose Microsoft.AspNetCore.SignalR.Protocols.MessagePack package depends on MessagePack 2.5.301. Earlier NES releases depend on MessagePack 2.1.90, which predates the vulnerable code. Exposure is conditional: AllowAssemblyVersionMismatch defaults to false, and SignalR's default MessagePack options do not change it, so only applications that enable it on options used for untrusted data, together with a formatter that reads type names, are exposed.

Details

Module Info

• Product: MessagePack-CSharp, as used by ASP.NET Core SignalR in NES for .NET 6
• Affected packages: MessagePack (an opt-in NuGet dependency of Microsoft.AspNetCore.SignalR.Protocols.MessagePack, not part of the shared framework)
• Affected versions:
  
  • MessagePack >= 2.1.115 < 2.5.305
  • MessagePack >= 3.0 < 3.1.10
  • Microsoft.AspNetCore.SignalR.Protocols.MessagePack >= 6.0.42 <= 6.0.46 (NES for .NET)
• Package manager: NuGet
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: MessagePack on NuGet
• Fixed in: NES for .NET 6.0.47 (MessagePack 2.5.307)

Vulnerability Info

This Medium-severity vulnerability is found in the MessagePack package in versions 2.1.115 up to 2.5.305 (v2) and 3.0 up to 3.1.10 (v3) of MessagePack for C#. When AllowAssemblyVersionMismatch is enabled and a type name fails to load, MessagePackSerializerOptions strips the assembly version from it with AssemblyNameVersionSelectorRegex. The version segment of that pattern uses unescaped . characters between \d+ groups, so a dot can match a digit and the engine tries a polynomial number of ways to split a long digit string before giving up. The regex has no match timeout. A type name of a few kilobytes, carried by TypelessFormatter or TypeFormatter, can block a thread for minutes, and a handful of concurrent requests can exhaust the thread pool. The fix escapes the dots.

NES for .NET 6.0.47 moves the SignalR MessagePack protocol to MessagePack 2.5.307, which includes this fix along with the fixes for CVE-2026-92707 and GHSA-7rj2-5w9w-r9jx. Blazor Server's compiled copy of MessagePack does not include this code.

This vulnerability has been present since MessagePack-CSharp 2.1.115, when MessagePackSerializerOptions was introduced.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.305
  • MessagePack >= 3.1.10
• Do not enable AllowAssemblyVersionMismatch on serializer options used for untrusted data.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

zx (GitHub: @manus-pi) and @manus-use (reporters); Andrew Arnott from the MessagePack-CSharp project (remediation developer)