CVE-2020-5234

MEDIUM EPSS 72.4%
Published Jan 31, 20206y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Jan 31, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
72.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-121
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 9

VendorProductVersionRange
messagepackmessagepack* <1.9.3
messagepackmessagepack*≥2.0.323  –  <2.1.80
messagepackmessagepack2.0.94any
messagepackmessagepack2.0.110any
messagepackmessagepack2.0.119any
messagepackmessagepack2.0.123any
messagepackmessagepack2.0.204any
messagepackmessagepack2.0.270any
messagepackmessagepack2.0.299any

References 4

  • github.com https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
    PatchThird Party Advisory
  • github.com https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007
  • github.com https://github.com/neuecc/MessagePack-CSharp/issues/810
  • github.com https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
    Third Party Advisory

Remediation

  • github.com https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02
    PatchThird Party Advisory