Read the docs
TI-2018-06092 Aliases CVE-2018-8409GHSA-j378-6mmw-hqfr

A denial of service vulnerability exists when System.IO.Pipelines improperly handles…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.

Why it matters now

EPSS 0.06558 93rd percentileScored 2026-11-07
Fix Fixed Microsoft.AspNetCore.All (NuGet): 2.1.4Microsoft.AspNetCore.App (NuGet): 2.1.4+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSystem.IO.PipelinesSystem.IO.Pipelines—No fix listedCNA
Microsoft.NET Core2.1—No fix listedCNA
MicrosoftASP.NET Core2.1—No fix listedCNA
—Microsoft.AspNetCore.All (NuGet)2.1.0 to before 2.1.42.1.4Patch availableGHSA-j378-6mmw-hqfr
—Microsoft.AspNetCore.App (NuGet)2.1.0 to before 2.1.42.1.4Patch availableGHSA-j378-6mmw-hqfr
—System.IO.Pipelines (NuGet)4.5.0 to before 4.5.14.5.1Patch availableGHSA-j378-6mmw-hqfr
  • System.IO.Pipelines VendorMicrosoft Affected System.IO.Pipelines Fixed in — No fix listed CNA
  • .NET Core VendorMicrosoft Affected 2.1 Fixed in — No fix listed CNA
  • ASP.NET Core VendorMicrosoft Affected 2.1 Fixed in — No fix listed CNA
  • Microsoft.AspNetCore.All (NuGet) Vendor— Affected 2.1.0 to before 2.1.4 Fixed in 2.1.4 Patch available GHSA-j378-6mmw-hqfr
  • Microsoft.AspNetCore.App (NuGet) Vendor— Affected 2.1.0 to before 2.1.4 Fixed in 2.1.4 Patch available GHSA-j378-6mmw-hqfr
  • System.IO.Pipelines (NuGet) Vendor— Affected 4.5.0 to before 4.5.1 Fixed in 4.5.1 Patch available GHSA-j378-6mmw-hqfr

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*2.1 to before 2.1.4VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*2.1 to before 2.1.4VulnerableMicrosoft
cpe:2.3:a:microsoft:system.io.pipelines:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:* Versions 2.1 to before 2.1.4 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* Versions 2.1 to before 2.1.4 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:system.io.pipelines:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-j378-6mmw-hqfr Microsoft.AspNetCore.All (NuGet) Fixed in 2.1.4 Advisory →
  • Fix · GHSA-j378-6mmw-hqfr Microsoft.AspNetCore.App (NuGet) Fixed in 2.1.4 Advisory →
  • Fix · GHSA-j378-6mmw-hqfr System.IO.Pipelines (NuGet) Fixed in 4.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 4 products
  • .NET Core 1.0 on Red Hat Enterprise Linux
  • .NET Core 1.1 on Red Hat Enterprise Linux
  • .NET Core 2.0 on Red Hat Enterprise Linux
  • .NET Core 2.1 on Red Hat Enterprise Linux

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8409
  2. 2026-10-03 Alias added: GHSA-j378-6mmw-hqfr

References

Patch 1

Advisory 2

  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-00583 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2020-00582 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2021-06407 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-11690 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences