Description
When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.
Recommendation
Update the msgpackr package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.10.1
- Patched version(s): 1.10.1
References
Could your website be exposed too?
SmartScanner can check your website for msgpackr's conversion of property names to strings can trigger infinite recursion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Valibot: record() issue paths can make flatten() throw for inherited Object property names - CVE-2026-59952
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
- Sandbox escape via infinite recursion and error objects - CVE-2026-25533
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
You might also like:
See something that needs correcting? Let us knowUpdated January 10, 2024