Cloudanix VulnDB

GHSA-92vj-hp7m-gwcj

Medium · 5.3

Nerdbank.MessagePack has Inefficient CPU Computation

CVSS

5.3

EPSS

—

Published

May 29, 2026

CISA due date

—

The record

Applications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an `ExpandoObject`, whose `Add` method is implemented as an `O(n)` algorithm.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities