What’s Vulnerable › Vulnerabilities

CVE-2020-5234: Untrusted data can lead to DoS attack in MessagePack for C# and Unity

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-31 · updated 2026-06-17
• Weakness: CWE-121

Description

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

Affected products

• MessagePack-CSharp: before 1.9.3; from 2.0.323 before 2.1.80; 2.0.94-alpha, 2.0.110-alpha, 2.0.119-beta, 2.0.123-beta, 2.0.204-beta, 2.0.270-rc (+1) — fixed in 1.9.3, 2.1.80

How to fix

Upgrade to a fixed version: MessagePack-CSharp 1.9.3, 2.1.80. Check the vendor advisory for mitigations.

References

• https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
• https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
• https://github.com/neuecc/MessagePack-CSharp/issues/810
• https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
• https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
• https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
• https://github.com/neuecc/MessagePack-CSharp/issues/810
• https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf

Get alerted when CVE-2020-5234 or the next vulnerability affects your stack