{"id":"GHSA-92vj-hp7m-gwcj","summary":"Nerdbank.MessagePack has Inefficient CPU Computation","details":"### Impact\n\nApplications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an `ExpandoObject`, whose `Add` method is implemented as an `O(n)` algorithm.\n\n### Patches\n\nUpdate to a patched version.\n\nIf a project's `ExpandoObject` data requires more than 128 properties, the default limit should be changed:\n\n```cs\nthis.Serializer = this.Serializer with\n{\n\tStartingContext = this.Serializer.StartingContext with\n\t{\n\t\tSecurity = this.Serializer.StartingContext.Security with\n\t\t{\n\t\t\tExpandoObjectMaxPropertyCount = 256, // Set this to whatever limit is required by your application\n\t\t},\n\t},\n};\n```\n\n### Workarounds\n\nAvoid the non-default `WithExpandoObjectConverter` extension method when deserializing untrusted data.\nIf deserializing untrusted data into an `ExpandoObject` is required, developers should write a custom converter for their project that limits the number of properties allowed before initializing the object.","modified":"2026-05-29T20:15:13.171119126Z","published":"2026-05-29T20:02:59Z","database_specific":{"github_reviewed_at":"2026-05-29T20:02:59Z","nvd_published_at":null,"cwe_ids":["CWE-1176"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-92vj-hp7m-gwcj"},{"type":"WEB","url":"https://github.com/AArnott/Nerdbank.MessagePack/commit/c5a239e4f20c38548de44c4dd2a782efd5e2547c"},{"type":"PACKAGE","url":"https://github.com/AArnott/Nerdbank.MessagePack"}],"affected":[{"package":{"name":"Nerdbank.MessagePack","ecosystem":"NuGet","purl":"pkg:nuget/Nerdbank.MessagePack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}],"versions":["0.1.705-alpha-gad428877b7","0.1.734-alpha-g09268fd45c","0.10.2-rc","0.10.7-rc","0.2.108-alpha","0.2.2-alpha","0.2.34-alpha","0.2.52-alpha","0.2.82-alpha","0.3.120-beta","0.3.151-beta","0.3.161-beta","0.3.2-alpha","0.3.27-alpha","0.3.38-beta","0.4.5-beta","0.5.1-beta","0.5.37-beta","0.5.57-beta","0.5.72-beta","0.5.80-beta","0.6.1-beta","0.6.27-beta","0.6.7-beta","0.7.1-beta","0.8.1-rc","0.8.102-rc","0.8.111-rc","0.8.128-rc","0.8.131-rc","0.8.30-rc","0.8.46-rc","0.8.54-rc","0.8.67-rc","0.8.82-rc","0.8.90-rc","0.8.92-rc","0.9.12-rc","0.9.14-rc","0.9.23-rc","0.9.26-rc","0.9.35-rc","1.0.11","1.0.2","1.0.40","1.0.43","1.1.25","1.1.62","1.1.78"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-92vj-hp7m-gwcj/GHSA-92vj-hp7m-gwcj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}