GHSA-86xp-94pg-8r6r

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignalR's MessagePack protocol can consume excessive memory while deserializing deeply nested attacker-controlled arrays, resulting in unauthenticated remote denial of service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/473 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.3 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` - **Weakness:** CWE-1325 (Improperly Controlled Sequential Memory Allocation) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 10.0.0, <= 10.0.12 | 10.0.13 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 11.0.0-preview.5, <= 11.0.0-rc.1 | 11.0.0-rc.2 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 8.0.0, <= 8.0.31 | 8.0.32 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 9.0.0, <= 9.0.20 | 9.0.21 ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? If using a package list