MessagePack-C# JSON Conversion Uncontrolled Recursion (CVE-2024-48512)

Vulnerability Overview Title: JSON conversion APIs can recurse without consistent depth enforcement Description: MessagePack-C#'s JSON conversion helpers contain multiple recursive type methods that inconsistently enforce depth limits in the JSON conversion components, as opposed to normal typed MessagePack deserialization. Impact Scope Affected Versions: [0.0.2.5.300], [3.0.3.1.7] Fixed Versions: 2.5.301, 3.1.7 Impact: Applications are affected when they invoke MessagePack-C#'s JSON conversion APIs with attacker-controlled JSON data. This includes gateways, diagnostic endpoints, migration tools, logging paths, and services that convert external JSON and MessagePack payloads to JSON. For JSON to MessagePack conversion, deeply nested JSON arrays or objects can recurse via without applying the configured graph depth limit. Additionally, long sequences of comma or colon delimiters can recurse via without consuming stack frames prior to normal structural validation. For MessagePack to JSON conversion, nested untyped extension wrappers can recurse via without applying the same depth enforcement functions that are applied to arrays and maps. does not fully mitigate these conversion paths because missing checks appear in the JSON conversion and tokenization branches, which do not consistently use the configured depth limits. Remediation Patch: The fix is ready and will be released in a coordinated patch version. Upgrade Guide: 1. Upgrade to the patch version of the release line. 2. Upgrade associated MessagePack packages within the same dependency graph to the coordinated patch versions. JSON to MessagePack Fix: The JSON nesting depth limit should be applied via , using the configured maximum object graph depth or an equivalent value, or the conversion should be rewritten to use an iterated bounded stack. MessagePack to JSON Fix: and matching cleanup should be applied via , removing the untyped extension branches from recursive calls to align with existing array and map conversion branches. Workarounds: Before patch versions are available, do not pass untrusted JSON directly to , nor call to expand MessagePack payloads that may contain untyped extension values. Validate JSON nesting depth, use parsers that enforce depth limits, reject malformed JSON before invoking MessagePack-C#, and strictly limit input size. References MESSAGEPACKCSHARP-000: Unbounded structural recursion in MESSAGEPACKCSHARP-001: Delimiter self-recursion in MESSAGEPACKCSHARP-002: Missing depth enforcement in untyped extension branch of CVE-674: Unbounded recursion CVE ID CVE-2024-48512 Credits AArnott: Remediation developer CVSS v4 Base Metrics Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: Low Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Weakness CWE-674: Uncontrolled Recursion Patch Status The patch is ready and will be released in a coordinated patch version.

Goal Reached Thanks to every supporter — we hit 100%!

MessagePack-C# JSON Conversion Uncontrolled Recursion (CVE-2024-48512)

More from this source