AIKIDO-2026-233096

TL;DR

PrimitiveObjectFormatter allocates an object[] sized to the declared array length before the configured maximum object-graph depth is enforced, when deserializing untrusted MessagePack data into System.Object. Because nested array headers can reuse the same trailing byte count for length validation, a roughly 31.5 KiB payload can trigger about 114.7 MiB of managed-heap allocation, an amplification of about 3,800x, before the depth check finally rejects it. Repeated requests cause severe memory pressure, excessive garbage collection, and process termination or loss of availability, reachable remotely for example through an ASP.NET Core SignalR hub method that accepts an object parameter with the MessagePack protocol enabled. The fix enforces the depth limit before allocating the declared array length.