Certain types that inherit from IDictionary are blocked from deserialization (KB5043462)

Symptoms

Some types that inherit from IDictionary are blocked from deserialization after applying September 2024 security updates for SharePoint Server. When this issue occurs, the following error message and "4nsby" or "4nss4" event tags are logged in SharePoint Unified Logging System (ULS) logs:

Cause

This issue occurs because the type is not in the allow list of deserializations.

Workaround

If the issue occurs in the w3wp.exe process, the farm administrator can work around this issue by adding the blocked types to the trusted list in the Web.config file, but only if you are sure that these types are safe.

To do this, add a new AllowedItem element with the name AllowedIDictionaryType and specify either a Type or an Assembly property. This element should be added under the configuration/SharePoint/SafeMode/AllowedListItems section in the Web.config file. Following is an example:

<SafeMode

            MaxControls = "200" 

            CallStack = "false"

            DirectFileDependencies ="10"

            TotalFileDependencies = "250"

            AllowPageLevelTrace = "false"

            ControlCompatMode="false"

            >

            <PageParserPaths>

            </PageParserPaths>

         <AllowedListItems>

                     <AllowedItem Name="AllowedIDictionaryType" Type="Microsoft.SharePoint.Portal.WebControls.RSSAggregatorWebPart, Microsoft.SharePoint.Portal, Version=15.0.0.0, Culture=neutral, PublicKeyToken=xxxxxx"/>

                   <AllowedItem Name="AllowedIDictionaryType" Assembly="System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=xxxxxx"/>

         </AllowedListItems>

</SafeMode>