CVE-2024-43484

What it actually does

The System.IO.Packaging library accepts untrusted inputs that trigger algorithmically complex operations, resulting in excessive resource consumption and denial of service.

Why it matters to the business

Applications handling package files can become unresponsive or crash under load, disrupting services and requiring manual restarts or restarts until the vulnerable code path is avoided.

How an attack unfolds

An attacker supplies a specially crafted package file or stream to any application using the vulnerable System.IO.Packaging library; the library performs expensive algorithmic work on the untrusted data, exhausting CPU or memory and causing the process to hang or terminate.

How to fix it

Update all applications that reference System.IO.Packaging to a build containing commit cbc9971f29b95d0b47a2ad272305ea4af300b1fb. Rebuild and redeploy affected .NET applications after the update. Where immediate patching is not possible, restrict untrusted package inputs or apply application-level rate limiting and resource quotas.

How to confirm the fix worked

Confirm the updated commit is present in the deployed System.IO.Packaging assembly or source tree; re-test with known complex package inputs to verify that CPU and memory usage remain bounded.

Typical attack path

1. Locate an application or service that accepts package files or streams through System.IO.Packaging
2. Generate or mutate input that forces the library into high-complexity code paths
3. Deliver the input via file upload, network request, or local file system
4. Observe resource exhaustion and service unavailability

How to detect it

Review application and system logs for sudden spikes in CPU or memory usage during package processing; correlate with file uploads or streams containing package formats; look for process terminations or restarts without other indicators.

What your security team should do

• Prioritize upgrade of all .NET applications using System.IO.Packaging to the fixed commit
• Inventory internal and third-party components that depend on the library
• Implement input validation and size limits on package processing until patches are applied
• Monitor for sudden spikes in CPU or memory on services handling package data