{"answers":{"affected":"4 open source packages ship an affected version, including MessagePack.","exploited":"There is no known exploitation of CVE-2024-48924 in the wild and no public exploit code.","fix":"Upgrade MessagePack to a fixed version for your release line: 2.5.187 or 3.0.214-rc.1.","what":"CVE-2024-48924 is a high-severity denial of service vulnerability in MessagePack-CSharp, published on 17 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-48924 and fix it if it is affected.\n\nWhat it is: CVE-2024-48924 is a high-severity denial of service vulnerability in MessagePack-CSharp, published on 17 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-48924 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- MessagePack (NuGet): affected all versions; fixed in 2.5.187\n- MessagePack (NuGet): affected all versions; fixed in 2.5.187\n- MessagePack (NuGet): affected from 2.6.95-alpha; fixed in 3.0.214-rc.1\n- MessagePack (NuGet): affected from 2.6.95-alpha; fixed in 3.0.214-rc.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-48924/ (Markdown: https://insights.sbomify.com/CVE-2024-48924/index.md)","id":"CVE-2024-48924","markdown":"https://insights.sbomify.com/CVE-2024-48924/index.md","name":"CVE-2024-48924","record":{"aliases":["ECHO-d0e4-8926-1c6a","GHSA-4qm4-8hg2-g2xm"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"MessagePack .NET library","requires_auth":"none","summary":"Attackers can cause denial of service via hash collisions and stack overflow when deserializing untrusted MessagePack data.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-328","name":"Use of Weak Hash"}],"description":"### Impact\n\nWhen this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized.\n\nThis is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability.\n\n### Patches\n\nThe following steps are required to mitigate this risk.\n\n1. Upgrade to a version of the library where a fix is available.\n1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data.\n\n### Workarounds\n\nIf upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows:\n\n1. Declare a class that derives from `MessagePackSecurity`.\n2. Override the `GetHashCollisionResistantEqualityComparer\u003cT\u003e` method to provide a collision-resistant hash function of your own and avoid calling `base.GetHashCollisionResistantEqualityComparer\u003cT\u003e()`.\n3. Configure a `MessagePackSerializerOptions` with an instance of your derived type by calling `WithSecurity` on an existing options object.\n4. Use your custom options object for all deserialization operations. This may be by setting the `MessagePackSerializer.DefaultOptions` static property, if you call methods that rely on this default property, and/or by passing in the options object explicitly to any `Deserialize` method.\n\n### References\n\n- Learn more about best security practices when reading untrusted data with [MessagePack 1.x](https://github.com/MessagePack-CSharp/MessagePack-CSharp/tree/v1.x#security) or [MessagePack 2.x](https://github.com/MessagePack-CSharp/MessagePack-CSharp#security).\n- The .NET team's [discussion on hash collision vulnerabilities of their `HashCode` struct](https://github.com/GrabYourPitchforks/runtime/blob/threat_models/docs/design/security/System.HashCode.md).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Start a public discussion](https://github.com/MessagePack-CSharp/MessagePack-CSharp/discussions)\n* [Email us privately](mailto:andrewarnott@live.com)","ecosystems":["NuGet"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow","id":"CVE-2024-48924","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":4,"n_references":3,"next":{"headline":"Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API","id":"CVE-2024-48925"},"packages":[{"ecosystem":"NuGet","fixed":["2.5.187"],"introduced":["0"],"last_affected":[],"package":"MessagePack","purl":null,"source":"GHSA-4qm4-8hg2-g2xm"},{"ecosystem":"NuGet","fixed":["2.5.187"],"introduced":["0"],"last_affected":[],"package":"MessagePack","purl":"pkg:nuget/MessagePack","source":"GHSA-4qm4-8hg2-g2xm"},{"ecosystem":"NuGet","fixed":["3.0.214-rc.1"],"introduced":["2.6.95-alpha"],"last_affected":[],"package":"MessagePack","purl":null,"source":"GHSA-4qm4-8hg2-g2xm"},{"ecosystem":"NuGet","fixed":["3.0.214-rc.1"],"introduced":["2.6.95-alpha"],"last_affected":[],"package":"MessagePack","purl":"pkg:nuget/MessagePack","source":"GHSA-4qm4-8hg2-g2xm"}],"prev":{"headline":"Kyverno's PolicyException objects can be created in any namespace by default","id":"CVE-2024-48921"},"products":["MessagePack-CSharp"],"published":"2024-10-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-18","vendors":["MessagePack-CSharp"]},"summary":"Attackers can cause denial of service via hash collisions and stack overflow when deserializing untrusted MessagePack data.","url":"https://insights.sbomify.com/CVE-2024-48924/"}