Vulnerability CVE-2024-43485

[jerone]

This package has a. .NET Denial of Service Vulnerability.

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Text.Json 6.0.x and 8.0.x. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

In System.Text.Json 6.0.x and 8.0.x, applications which deserialize input to a model with an [ExtensionData] property can be vulnerable to an algorithmic complexity attack resulting in Denial of Service.

https://osv.dev/vulnerability/GHSA-8g4q-xg66-9fp4
GHSA-8g4q-xg66-9fp4

System.Text.Json is a dependency of System.Net.Http.Json, which is used in this package:

Moq.Contrib.HttpClient/Moq.Contrib.HttpClient/Moq.Contrib.HttpClient.csproj

Line 21 in 8d3dc66

<PackageReference Include="System.Net.Http.Json" Version="6.0.0" />

[jerone]

Ping @maxkagamine