MessagePack.ImmutableCollection

Extremely Fast MessagePack Serializer for C#(.NET, .NET Core, Unity, Xamarin). / msgpack.org[C#]

View on Nuget

View on Github

Activity

Latest release: 2w ago
Total releases: 139
Cadence: ~10 days
Last 12 months: 14

Reach

Stars: 6.8k

Details

License: MIT
First release: Feb 28, 2017

Releases

Version	Released
`3.1.12` patch	Oct 12, 2026
`3.1.11` patch	Oct 03, 2026
`2.5.307` patch	Oct 03, 2026
`2.5.305` patch	Sep 23, 2026
`3.1.10` patch	Sep 23, 2026
`3.1.9` patch	Sep 17, 2026
`2.5.303` patch	Sep 17, 2026
`3.1.8` patch	Jul 08, 2026
`3.1.7` patch	Jun 09, 2026
`2.5.302` patch	Jun 09, 2026
`2.5.301` patch	Jun 09, 2026
`2.5.205` patch	May 21, 2026
`3.1.6` patch	May 21, 2026
`3.1.5` patch	May 21, 2026
`3.1.4` patch	Jun 12, 2025
`2.5.198` patch	Apr 10, 2025
`3.1.3` patch	Feb 04, 2025
`3.1.2` patch	Jan 27, 2025
`3.1.1` patch	Dec 26, 2024
`3.1.0` minor	Dec 12, 2024
`3.0.308` patch	Dec 09, 2024
`3.0.300` patch	Dec 06, 2024
`3.0.3` major	Dec 06, 2024
`2.5.192` patch	Nov 12, 2024
`3.0.238-rc.1` pre	Oct 23, 2024
`3.0.233-rc.1` pre	Oct 22, 2024
`3.0.214-rc.1` pre	Oct 17, 2024
`2.5.187` patch	Oct 17, 2024
`3.0.208-rc-0001` pre	Oct 16, 2024
`2.5.172` patch	Aug 01, 2024
`3.0.134-beta` pre	Jul 29, 2024
`3.0.129-beta` pre	Jul 26, 2024
`3.0.111-alpha` pre	Jul 06, 2024
`2.5.171` patch	Jul 05, 2024
`2.5.168` patch	Jun 06, 2024
`3.0.54-alpha` pre	May 12, 2024
`2.5.140` patch	Nov 30, 2023
`2.5.129` patch	Sep 28, 2023
`2.5.124` patch	Jun 27, 2023
`2.6.100-alpha` pre	May 20, 2023
`2.6.95-alpha` pre	May 19, 2023
`2.5.108` patch	Mar 16, 2023
`2.5.103` patch	Mar 14, 2023
`2.5.94` minor	Mar 13, 2023
`2.5.64-alpha` pre	Dec 03, 2022
`2.4.59` patch	Nov 20, 2022
`2.4.35` minor	Jun 28, 2022
`2.4.23-alpha` pre	Jun 09, 2022
`2.3.112` patch	Jun 09, 2022
`2.4.14-alpha` pre	Feb 28, 2022

1–50 of 139

Repository

messagepack-csharp/messagepack-csharp

Forks: 778
Open issues: 132
Language: C#

messagepack
unity
serialization
xamarin
c-sharp
msgpack

Dependencies (9)

Depends on

3.1.12

Used by

Supply-chain exposure

8 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2020-5234 GHSA-7q36-4xx7-xcxf Jan 31, 2020

Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack

4.8 / 10
Medium
Network High Low Required Unchanged None None High

Impact

When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors:

hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized.

stack overflow - leading to the deserializing process crashing.

Patches

The following steps are required to mitigate this risk.

Upgrade to a version of the library where a fix is available

Add code to your application to put MessagePack into the defensive UntrustedData mode.

Identify all MessagePack extensions that implement IMessagePackFormatter<T> implementations that do not ship with the MessagePack library to include the security mitigations. This includes those acquired from 3rd party packages and classes included directly into your project. Any AOT formatters generated with the MPC tool must be regenerated with the patched version of mpc.

Review your messagepack-serializable data structures for hash-based collections that use custom or unusual types for the hashed key. See below for details on handling such situations.

Review the MessagePackSecurity class to tweak any settings as necessary to strike the right balance between performance, functionality, and security.

Specialized IEqualityComparer<T> implementations provide the hash collision resistance. Each type of hashed key may require a specialized implementation of its own. The patched MessagePack library includes many such implementations for primitive types commonly used as keys in hash-based collections. If your data structures use custom types as keys in these hash-based collections, putting MessagePack in UntrustedData mode may lead the deserializer to throw an exception because no safe IEqualityComparer<T> is available for your custom T type. You can provide your own safe implementation by deriving from the MessagePackSecurity class and overriding the GetHashCollisionResistantEqualityComparer<T>() method to return your own custom implementation when T matches your type, and fallback to return base.GetHashCollisionResistantEqualityComparer<T>(); for types you do not have custom implementations for.

Unrelated to this advisory, but as general security guidance, you should also avoid the Typeless serializer/formatters/resolvers for untrusted data as that opens the door for the untrusted data to potentially deserialize unanticipated types that can compromise security.

MessagePack 1.x users

Upgrade to any 1.9.x version.

When deserializing untrusted data, put MessagePack into a more secure mode with:

MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;

In MessagePack v1.x this is a static property and thus the security level is shared by the entire process or AppDomain. Use MessagePack v2.1 or later for better control over the security level for your particular use.

Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called Generated.cs. A patched Generated.cs file will typically reference the MessagePackSecurity class.

Review any custom-written IMessagePackFormatter<T> implementations in your project or that you might use from 3rd party packages to ensure they also utilize the MessagePackSecurity class as required. In particular, a formatter that deserializes an object (as opposed to a primitive value) should wrap the deserialization in a using (MessagePackSecurity.DepthStep()) block. For example:

public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options) { if (reader.TryReadNil()) { return default; } else { using (MessagePackSecurity.DepthStep()) // STACK OVERFLOW MITIGATION { MyObject o = new MyObject(); // deserialize members of the object here. return o; } } }

If your custom formatter creates hash-based collections (e.g. Dictionary<K, V> or HashSet<T>) where the hashed key comes from the messagepack data, always instantiate your collection using MessagePackSecurity.Active.GetEqualityComparer<T>() as the equality comparer:

var collection = new HashSet<T>(MessagePackSecurity.Active.GetEqualityComparer<T>());

This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.

Learn more about best security practices when reading untrusted data with MessagePack 1.x.

MessagePack 2.x users

Upgrade to any 2.1.x or later version.

When deserializing untrusted data, put MessagePack into a more secure mode by configuring your MessagePackSerializerOptions.Security property:

var options = MessagePackSerializerOptions.Standard .WithSecurity(MessagePackSecurity.UntrustedData); // Pass the options explicitly for the greatest control. T object = MessagePackSerializer.Deserialize<T>(data, options); // Or set the security level as the default. MessagePackSerializer.DefaultOptions = options;

Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called Generated.cs. A patched Generated.cs file will typically reference the Security member on the MessagePackSerializerOptions parameter.

Review any custom-written IMessagePackFormatter<T> implementations in your project or that you might use from 3rd party packages to ensure they also utilize the MessagePackSecurity class as required. In particular, a formatter that deserializes an object (as opposed to a primitive value) should call options.Security.DepthStep(ref reader); before deserializing the object's members, and be sure to revert the depth step with reader.Depth--; before exiting the method. For example:

public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options) { if (reader.TryReadNil()) { return default; } else { options.Security.DepthStep(ref reader); // STACK OVERFLOW MITIGATION, line 1 try { MyObject o = new MyObject(); // deserialize members of the object here. return o; } finally { reader.Depth--; // STACK OVERFLOW MITIGATION, line 2 } } }

If your custom formatter creates hash-based collections (e.g. Dictionary<K, V> or HashSet<T>) where the hashed key comes from the messagepack data, always instantiate your collection using options.Security.GetEqualityComparer<TKey>() as the equality comparer:

var collection = new HashSet<T>(options.Security.GetEqualityComparer<T>());

This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.

Learn more about best security practices when reading untrusted data with MessagePack 2.x.

Workarounds

The security vulnerabilities are in the formatters. Avoiding the built-in formatters entirely in favor of reading messagepack primitive data directly or relying on carefully written custom formatters can provide a workaround.

MessagePack v1.x users may utilize the MessagePackBinary static class directly to read the data they expect. MessagePack v2.x users may utilize the MessagePackReader struct directly to read the data they expect.

References

Learn more about best security practices when reading untrusted data with MessagePack 1.x or MessagePack 2.x.

For more information

If you have any questions or comments about this advisory:

Open an issue in MessagePack-CSharp

Email us

Affected versions

0.2.0-beta0.3.0-beta0.4.00.4.10.4.20.5.00.6.00.6.10.7.00.7.20.8.00.8.1

+ 65 more Show less

0.8.20.8.30.8.40.8.51.0.01.0.11.0.21.0.31.1.01.1.11.1.21.2.01.2.21.2.31.3.01.3.11.3.1.11.3.21.3.31.4.01.4.11.4.21.4.31.4.41.5.01.5.0.11.5.0.21.5.11.6.01.6.0.11.6.0.21.6.0.31.6.11.6.1.11.6.1.21.6.21.7.01.7.11.7.21.7.31.7.3.11.7.3.21.7.3.31.7.3.41.7.3.71.8.71-beta1.8.741.8.801.9.31.9.3-g129239b1072.0.107-alpha2.0.108-alpha2.0.110-alpha2.0.110-alpha-g1e44a9106f2.0.119-beta2.0.123-beta2.0.171-beta2.0.204-beta2.0.221-beta2.0.231-rc2.0.270-rc2.0.299-rc2.0.3232.0.3352.1.80

Fixed in

1.9.112.1.90

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf
https://nvd.nist.gov/vuln/detail/CVE-2020-5234
https://github.com/aspnet/Announcements/issues/405
https://github.com/neuecc/MessagePack-CSharp/issues/810
https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 3
minor 19
patch 87
pre 29

139 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More