Advisories for Nuget/MessagePack package

A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination …

When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.

When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors: hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized. stack overflow - leading to the deserializing process crashing.