GHSA-92vj-hp7m-gwcj: Nerdbank.MessagePack has Inefficient CPU Computation
Applications that call OptionalConverters.WithExpandoObjectConverter and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a O(n²) algorithm to burn an inordinate amount of CPU effort by adding a great many properties to an ExpandoObject, whose Add method is implemented as an O(n) algorithm.
References
Code Behaviors & Features
Detect and mitigate GHSA-92vj-hp7m-gwcj with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →