.NET Core & .NET Framework Denial of Service Vulnerability
Priority MEDIUM 42Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
Why it matters now
EPSS 0.06462 93rd percentileScored 2026-11-07
Fix Fixed .NET 5.0 (Microsoft): publication.NET Core 2.1 (Microsoft): publication+32 more productsRed Hat: 8 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | .NET 5.0 | 5.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | .NET Core 2.1 | 2.1 to before publication | publication | Patch available | CNA |
| Microsoft | .NET Core 3.1 | 3.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.0 Service Pack 2 | 3.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 | 3.5.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 | 3.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.5.2 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.0 | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.5 | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | PowerShell 7.0 | 7.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | PowerShell Core 6.2 | 6.0 to before publication | publication | Patch available | CNA |
| — | Microsoft.NETCore.App (NuGet) | 2.1.0 to before 2.1.18 | 2.1.18 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.linux-arm (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.win-arm (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.win-x64 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
| — | Microsoft.NETCore.App.Runtime.win-x86 (NuGet) | 3.1.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3w5p-jhp5-c29q |
- .NET 5.0 VendorMicrosoft Affected 5.0.0 to before publication Fixed in publication Patch available CNA
- .NET Core 2.1 VendorMicrosoft Affected 2.1 to before publication Fixed in publication Patch available CNA
- .NET Core 3.1 VendorMicrosoft Affected 3.1 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 2.0 Service Pack 2 VendorMicrosoft Affected 2.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.0 Service Pack 2 VendorMicrosoft Affected 3.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 3.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 VendorMicrosoft Affected 3.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5.1 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.5.2 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.6 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected 15.9.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.0 VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.5 VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- PowerShell 7.0 VendorMicrosoft Affected 7.0.0 to before publication Fixed in publication Patch available CNA
- PowerShell Core 6.2 VendorMicrosoft Affected 6.0 to before publication Fixed in publication Patch available CNA
- Microsoft.NETCore.App (NuGet) Vendor— Affected 2.1.0 to before 2.1.18 Fixed in 2.1.18 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.win-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
- Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 3.1.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3w5p-jhp5-c29q
CPE configurations NVD · 52
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net:5.0:preview1:*:*:*:*:*:* | 5.0 preview1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net:5.0:preview2:*:*:*:*:*:* | 5.0 preview2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net:5.0:preview3:*:*:*:*:*:* | 5.0 preview3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:* | 2.1 – 2.1.18; 3.0 – 3.1.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* | 2.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* | 3.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* | 4.6 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net:5.0:preview1:*:*:*:*:*:* Versions 5.0 preview1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net:5.0:preview2:*:*:*:*:*:* Versions 5.0 preview2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net:5.0:preview3:*:*:*:*:*:* Versions 5.0 preview3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:* Versions 2.1 – 2.1.18; 3.0 – 3.1.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* Versions 3.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
Show 42 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* | 4.5.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* | 4.6.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:x64:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:x86:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:arm64:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x64:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x86:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x64:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x86:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:arm64:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* | 1909 | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* | 3.5.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:arm64:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_core:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* | 15.9 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:16.4:*:*:*:*:*:*:* | 16.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:16.5:*:*:*:*:*:*:* | 16.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:powershell:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:powershell_core:6.2:*:*:*:*:*:*:* | 6.2 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* Versions 4.6.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:x64:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:x86:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:arm64:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x64:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x86:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x64:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x86:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:arm64:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* Versions 1909 Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:arm64:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_core:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* Versions 15.9 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:16.4:*:*:*:*:*:*:* Versions 16.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:16.5:*:*:*:*:*:*:* Versions 16.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:powershell:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:powershell_core:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Microsoft
Remediation
- Fix · CNA .NET 5.0 (Microsoft) Fixed in publication
- Fix · CNA .NET Core 2.1 (Microsoft) Fixed in publication
- Fix · CNA .NET Core 3.1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 2.0 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.0 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5.1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.5.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.6 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.8 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.0 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.5 (Microsoft) Fixed in publication
- Fix · CNA PowerShell 7.0 (Microsoft) Fixed in publication
- Fix · CNA PowerShell Core 6.2 (Microsoft) Fixed in publication
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App (NuGet) Fixed in 2.1.18 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.win-arm (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Fixed in 3.1.4 Advisory →
- Fix · GHSA-3w5p-jhp5-c29q Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Fixed in 3.1.4 Advisory →
Red Hat 8 advisories
- RHSA-2020:2476 Released 2020-06-10 · Red Hat rating Important.NET Core on Red Hat Enterprise Linux 7 security update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet21-2.1-18.el7, rh-dotnet21-dotnet-2.1.515-1.el7, rh-dotnet21-dotnet-host-2.1.19-1.el7 +4
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet21-2.1-18.el7, rh-dotnet21-dotnet-2.1.515-1.el7, rh-dotnet21-dotnet-host-2.1.19-1.el7 +4
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet21-2.1-18.el7, rh-dotnet21-dotnet-2.1.515-1.el7, rh-dotnet21-dotnet-host-2.1.19-1.el7 +4
- RHSA-2020:2475 Released 2020-06-10 · Red Hat rating Important.NET Core on Red Hat Enterprise Linux 7 security update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.5-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.5-1.el7, rh-dotnet31-dotnet-3.1.105-1.el7 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.5-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.5-1.el7, rh-dotnet31-dotnet-3.1.105-1.el7 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.5-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.5-1.el7, rh-dotnet31-dotnet-3.1.105-1.el7 +8
- RHSA-2020:2471 Released 2020-06-10 · Red Hat rating Important.NET Core on Red Hat Enterprise Linux 8 security update
- Red Hat Enterprise Linux AppStream (v. 8) dotnet-2.1.515-1.el8_2, dotnet-host-fxr-2.1-2.1.19-1.el8_2, dotnet-runtime-2.1-2.1.19-1.el8_2 +2
Show 5 more Red Hat advisories
- RHSA-2020:2450 Released 2020-06-09 · Red Hat rating Important.NET Core 3.1 on Red Hat Enterprise Linux 8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-3.1-3.1.5-2.el8_2, aspnetcore-targeting-pack-3.1-3.1.5-2.el8_2, dotnet-3.1.105-2.el8_2 +9
- RHSA-2020:2250 Released 2020-05-21 · Red Hat rating Importantdotnet3.1 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-3.1-3.1.4-2.el8_2, aspnetcore-targeting-pack-3.1-3.1.4-2.el8_2, dotnet-3.1.104-2.el8_2 +9
- RHSA-2020:2249 Released 2020-05-21 · Red Hat rating Important.NET Core on Red Hat Enterprise Linux security and bug fix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.4-2.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.4-2.el7, rh-dotnet31-dotnet-3.1.104-2.el7 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.4-2.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.4-2.el7, rh-dotnet31-dotnet-3.1.104-2.el7 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.4-2.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.4-2.el7, rh-dotnet31-dotnet-3.1.104-2.el7 +8
- RHSA-2020:2146 Released 2020-05-13 · Red Hat rating Important.NET Core on Red Hat Enterprise Linux security and bug fix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet21-2.1-17.el7, rh-dotnet21-dotnet-2.1.514-2.el7, rh-dotnet21-dotnet-host-2.1.18-2.el7 +4
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet21-2.1-17.el7, rh-dotnet21-dotnet-2.1.514-2.el7, rh-dotnet21-dotnet-host-2.1.18-2.el7 +4
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet21-2.1-17.el7, rh-dotnet21-dotnet-2.1.514-2.el7, rh-dotnet21-dotnet-host-2.1.18-2.el7 +4
- RHSA-2020:2143 Released 2020-05-13 · Red Hat rating Important.NET Core security update
- Red Hat Enterprise Linux AppStream (v. 8) dotnet-2.1.514-2.el8_2, dotnet-host-fxr-2.1-2.1.18-2.el8_2, dotnet-runtime-2.1-2.1.18-2.el8_2 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:2146, RHSA-2020:2249, RHSA-2020:2475, RHSA-2020:2476 |
| .NET Core on Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:2146, RHSA-2020:2249, RHSA-2020:2475, RHSA-2020:2476 |
| .NET Core on Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:2146, RHSA-2020:2249, RHSA-2020:2475, RHSA-2020:2476 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:2143, RHSA-2020:2250, RHSA-2020:2450, RHSA-2020:2471 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1108
- 2026-10-03 Alias added: GHSA-3w5p-jhp5-c29q
References
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-1108 · CVE Program
- CVE-2020-1108 · NVD
- FIRST EPSS
- GHSA-3w5p-jhp5-c29q · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1108 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences