Read the docs
TI-2017-08821 Aliases CVE-2017-11883GHSA-f9jc-rrm2-pmfg

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".

Why it matters now

EPSS 0.08526 95th percentileScored 2026-11-07
Fix Fixed Microsoft.AspNetCore.Server.WebListener (NuGet): 1.0.6, 1.1.4Microsoft.Net.Http.Server (NuGet): 1.0.6, 1.1.4+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftASP.NETASP.NET Core 1.0, ASP.NET Core 1.1, ASP.NET Core 2.0—No fix listedCNA
—Microsoft.AspNetCore.Server.WebListener (NuGet)1.0.0 to before 1.0.61.0.6Patch availableGHSA-f9jc-rrm2-pmfg
—Microsoft.AspNetCore.Server.WebListener (NuGet)1.1.0 to before 1.1.41.1.4Patch availableGHSA-f9jc-rrm2-pmfg
—Microsoft.Net.Http.Server (NuGet)1.0.0 to before 1.0.61.0.6Patch availableGHSA-f9jc-rrm2-pmfg
—Microsoft.Net.Http.Server (NuGet)1.1.0 to before 1.1.41.1.4Patch availableGHSA-f9jc-rrm2-pmfg
—Microsoft.AspNetCore.Server.HttpSys (NuGet)2.0.0 to before 2.0.22.0.2Patch availableGHSA-f9jc-rrm2-pmfg
  • ASP.NET VendorMicrosoft Affected ASP.NET Core 1.0, ASP.NET Core 1.1, ASP.NET Core 2.0 Fixed in — No fix listed CNA
  • Microsoft.AspNetCore.Server.WebListener (NuGet) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-f9jc-rrm2-pmfg
  • Microsoft.AspNetCore.Server.WebListener (NuGet) Vendor— Affected 1.1.0 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-f9jc-rrm2-pmfg
  • Microsoft.Net.Http.Server (NuGet) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-f9jc-rrm2-pmfg
  • Microsoft.Net.Http.Server (NuGet) Vendor— Affected 1.1.0 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-f9jc-rrm2-pmfg
  • Microsoft.AspNetCore.Server.HttpSys (NuGet) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-f9jc-rrm2-pmfg

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:aspnetcore:1.0:*:*:*:*:*:*:*1.0VulnerableMicrosoft
cpe:2.3:a:microsoft:aspnetcore:1.1:*:*:*:*:*:*:*1.1VulnerableMicrosoft
cpe:2.3:a:microsoft:aspnetcore:2.0:*:*:*:*:*:*:*2.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:aspnetcore:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:aspnetcore:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:aspnetcore:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-f9jc-rrm2-pmfg Microsoft.AspNetCore.Server.WebListener (NuGet) Fixed in 1.0.6 Advisory →
  • Fix · GHSA-f9jc-rrm2-pmfg Microsoft.AspNetCore.Server.WebListener (NuGet) Fixed in 1.1.4 Advisory →
  • Fix · GHSA-f9jc-rrm2-pmfg Microsoft.Net.Http.Server (NuGet) Fixed in 1.0.6 Advisory →
  • Fix · GHSA-f9jc-rrm2-pmfg Microsoft.Net.Http.Server (NuGet) Fixed in 1.1.4 Advisory →
  • Fix · GHSA-f9jc-rrm2-pmfg Microsoft.AspNetCore.Server.HttpSys (NuGet) Fixed in 2.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • .NET Core 1.0 on Red Hat Enterprise Linux
  • .NET Core 1.1 on Red Hat Enterprise Linux
  • .NET Core 2.0 on Red Hat Enterprise Linux

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11883
  2. 2026-10-03 Alias added: GHSA-f9jc-rrm2-pmfg
  3. 2026-10-19 EPSS moved to the 95th–99th percentile

References

Patch 1

Advisory 1

Other 2

  • TI-2017-08723 Improper certificate validation in Microsoft .NET Core CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences