Résumé
msgpack5: Quadratic parsing in the streaming decoder
Détails de l’avis
Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- HIGHCVE-2026-69651
Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-96958
Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-84008
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- MEDIUMCVE-2026-70196
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
- HIGHCVE-2026-107378
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>