CVE-2020-5234 Untrusted data can lead to DoS attack in MessagePack for C# and Unity
Attackers can cause denial of service in MessagePack for C# and Unity via hash collisions and stack overflow using untrusted data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5234?
CVE-2020-5234 is a medium-severity denial of service vulnerability in neuecc MessagePack, published on 31 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Which versions are affected by CVE-2020-5234?
20 open source packages ship an affected version, including MessagePack, MessagePack.ImmutableCollection and MessagePack.ReactiveProperty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MessagePack NuGet | All versions | 1.9.11 |
MessagePack NuGet | All versions | 1.9.11 |
MessagePack NuGet | From 2.0.0 | 2.1.90 |
MessagePack NuGet | From 2.0.0 | 2.1.90 |
MessagePack.ImmutableCollection NuGet | All versions | 1.9.11 |
MessagePack.ImmutableCollection NuGet | All versions | 1.9.11 |
14 more packages
MessagePack.ImmutableCollection NuGet | From 2.0.0 | 2.1.90 |
MessagePack.ImmutableCollection NuGet | From 2.0.0 | 2.1.90 |
MessagePack.ReactiveProperty NuGet | All versions | 1.9.11 |
MessagePack.ReactiveProperty NuGet | All versions | 1.9.11 |
MessagePack.ReactiveProperty NuGet | From 2.0.0 | 2.1.90 |
MessagePack.ReactiveProperty NuGet | From 2.0.0 | 2.1.90 |
MessagePack.Unity NuGet | All versions | 1.9.11 |
MessagePack.Unity NuGet | All versions | 1.9.11 |
MessagePack.Unity NuGet | From 2.0.0 | 2.1.90 |
MessagePack.Unity NuGet | From 2.0.0 | 2.1.90 |
MessagePack.UnityShims NuGet | All versions | 1.9.11 |
MessagePack.UnityShims NuGet | All versions | 1.9.11 |
MessagePack.UnityShims NuGet | From 2.0.0 | 2.1.90 |
MessagePack.UnityShims NuGet | From 2.0.0 | 2.1.90 |
Products include Messagepack Messagepack.
How do I fix CVE-2020-5234?
Upgrade MessagePack to a fixed version for your release line: 1.9.11 or 2.1.90.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-5234 being exploited?
There is no known exploitation of CVE-2020-5234 in the wild and no public exploit code.
Other vulnerabilities in neuecc MessagePack
- CVE-2026-48109 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
- CVE-2026-48502 MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
- CVE-2026-48506 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
- CVE-2026-48509 MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
- CVE-2026-48510 MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Sources
Also known as AZL-109523, GHSA-7q36-4xx7-xcxf.