Skip to main content

Uncontrolled Recursion

CVE-2023-52079

Medium
6.5/10

Summary

The package msgpackr is a fast MessagePack NodeJS/JavaScript implementation. In msgpackr package versions prior to 1.10.1, when decoding user-supplied "MessagePack" messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. Exploits seem to require structured cloning, replacing the "0x70" extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-674 - Uncontrolled Recursion

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

Advisory Timeline

  • Published