ASP.NET Core Denial of Service Vulnerability
Priority MEDIUM 42CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Why it matters now
EPSS 0.06561 93rd percentileScored 2026-11-07
Fix Fixed ASP.NET Core 2.1 (Microsoft): publicationASP.NET Core 3.1 (Microsoft): publication+16 more productsRed Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | ASP.NET Core 2.1 | 2.0 to before publication | publication | Patch available | CNA |
| Microsoft | ASP.NET Core 3.1 | 3.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.0 | 16.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 to before publication | publication | Patch available | CNA |
| — | Microsoft.AspNetCore.App (NuGet) | 2.1.0 to before 2.1.21 | 2.1.21 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.All (NuGet) | 2.1.0 to before 2.1.21 | 2.1.21 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
| — | Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) | 3.1.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-f8qx-mjcq-wfgx |
- ASP.NET Core 2.1 VendorMicrosoft Affected 2.0 to before publication Fixed in publication Patch available CNA
- ASP.NET Core 3.1 VendorMicrosoft Affected 3.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected 15.9.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.0 VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft.AspNetCore.App (NuGet) Vendor— Affected 2.1.0 to before 2.1.21 Fixed in 2.1.21 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.All (NuGet) Vendor— Affected 2.1.0 to before 2.1.21 Fixed in 2.1.21 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-f8qx-mjcq-wfgx
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:asp.net_core:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* | 15.0 – 15.8 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* | 16.0 – 16.3; 16.5 – 16.6 | Vulnerable | Microsoft |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:asp.net_core:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* Versions 15.0 – 15.8 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.3; 16.5 – 16.6 Vulnerable ·Microsoft
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA ASP.NET Core 2.1 (Microsoft) Fixed in publication
- Fix · CNA ASP.NET Core 3.1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.0 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft) Fixed in publication
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App (NuGet) Fixed in 2.1.21 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.All (NuGet) Fixed in 2.1.21 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Fixed in 3.1.7 Advisory →
- Fix · GHSA-f8qx-mjcq-wfgx Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Fixed in 3.1.7 Advisory →
Red Hat 2 advisories
- RHSA-2020:3422 Released 2020-08-11 · Red Hat rating Important.NET Core 3.1 security and bugfix update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-3.1-3.1.7-1.el8_2, aspnetcore-targeting-pack-3.1-3.1.7-1.el8_2, dotnet-3.1.107-1.el8_2 +9
- RHSA-2020:3421 Released 2020-08-11 · Red Hat rating Important.NET Core 3.1 security and bugfix update for Red Hat Enterprise Linux
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.7-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.7-1.el7, rh-dotnet31-dotnet-3.1.107-1.el7 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.7-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.7-1.el7, rh-dotnet31-dotnet-3.1.107-1.el7 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.7-1.el7, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.7-1.el7, rh-dotnet31-dotnet-3.1.107-1.el7 +8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:3421 |
| .NET Core on Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:3421 |
| .NET Core on Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:3421 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3422 |
Not affected: 2 products
- .NET Core 2.1 on Red Hat Enterprise Linux
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1597
- 2026-10-03 Alias added: GHSA-f8qx-mjcq-wfgx
References
Advisory 3
Other 5
- https://github.com/dotnet/announcements/issues/162
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WH5FQ5VT3JGHXFXOETHCTBWJUIAPGHHT
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW4CBI26KSO3PRL3HLVVISXPPOYUHSXO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WH5FQ5VT3JGHXFXOETHCTBWJUIAPGHHT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZW4CBI26KSO3PRL3HLVVISXPPOYUHSXO
More Microsoft Asp.net Core vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
- TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
- TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2
Sources
- CVE-2020-1597 · CVE Program
- CVE-2020-1597 · NVD
- FIRST EPSS
- GHSA-f8qx-mjcq-wfgx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1597 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences