Summary
msgpack5: Quadratic parsing in the streaming decoder
Advisory details
Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- HIGHCVE-2026-69651
Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-96958
Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-84008
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- MEDIUMCVE-2026-70196
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
- HIGHCVE-2026-107378
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>