.NET Core and Visual Studio Denial of Service Vulnerability
Priority MEDIUM 45Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from Microsoft.
Summary
.NET Core and Visual Studio Denial of Service Vulnerability
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03902 90th percentileScored 2026-11-07
Fix Fixed .NET 5.0 (Microsoft): 5.0.9.NET Core 2.1 (Microsoft): 2.1.30+32 more productsRed Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | .NET 5.0 | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | CNA |
| Microsoft | .NET Core 2.1 | 2.1 to before 2.1.30 | 2.1.30 | Patch available | CNA |
| Microsoft | .NET Core 3.1 | 3.1 to before 3.1.18 | 3.1.18 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 to before 15.9.38 | 15.9.38 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) | 16.10.0 to before 16.10.5 | 16.10.5 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 to before 16.4.25 | 16.4.25 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 to before 16.7.18 | 16.7.18 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 to before 16.9.10 | 16.9.10 | Patch available | CNA |
| Microsoft | PowerShell Core 7.0 | 7.0.0 to before 7.0.7 | 7.0.7 | Patch available | CNA |
| Microsoft | PowerShell Core 7.1 | 7.1.0 to before 7.1.4 | 7.1.4 | Patch available | CNA |
| Microsoft | Visual Studio 2019 for Mac version 8.10 | 8.1.0 to before 8.10.7 | 8.10.7 | Patch available | CNA |
| — | Microsoft.NETCore.App.Runtime.win-x86 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-x86 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-x64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-arm (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.win-arm (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-musl-arm (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-arm (NuGet) | 3.1.0 to before 3.1.18 | 3.1.18 | Patch available | GHSA-rh58-r7jh-xhx3 |
| — | Microsoft.NETCore.App.Runtime.linux-arm (NuGet) | 5.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-rh58-r7jh-xhx3 |
- .NET 5.0 VendorMicrosoft Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available CNA
- .NET Core 2.1 VendorMicrosoft Affected 2.1 to before 2.1.30 Fixed in 2.1.30 Patch available CNA
- .NET Core 3.1 VendorMicrosoft Affected 3.1 to before 3.1.18 Fixed in 3.1.18 Patch available CNA
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected 15.9.0 to before 15.9.38 Fixed in 15.9.38 Patch available CNA
- Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) VendorMicrosoft Affected 16.10.0 to before 16.10.5 Fixed in 16.10.5 Patch available CNA
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before 16.4.25 Fixed in 16.4.25 Patch available CNA
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) VendorMicrosoft Affected 16.0.0 to before 16.7.18 Fixed in 16.7.18 Patch available CNA
- Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) VendorMicrosoft Affected 15.0.0 to before 16.9.10 Fixed in 16.9.10 Patch available CNA
- PowerShell Core 7.0 VendorMicrosoft Affected 7.0.0 to before 7.0.7 Fixed in 7.0.7 Patch available CNA
- PowerShell Core 7.1 VendorMicrosoft Affected 7.1.0 to before 7.1.4 Fixed in 7.1.4 Patch available CNA
- Visual Studio 2019 for Mac version 8.10 VendorMicrosoft Affected 8.1.0 to before 8.10.7 Fixed in 8.10.7 Patch available CNA
- Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.win-arm (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 3.1.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-rh58-r7jh-xhx3
- Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-rh58-r7jh-xhx3
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 5.0 – 5.0.8 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:* | 2.1 – 2.1.28; 3.1 – 3.1.17 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:* | 7.0 to before 7.0.7; 7.1 to before 7.1.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* | 15.0 – 15.9 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* | 16.0 – 16.10 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:8.10:*:*:*:*:macos:*:* | 8.10 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 5.0 – 5.0.8 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:* Versions 2.1 – 2.1.28; 3.1 – 3.1.17 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:* Versions 7.0 to before 7.0.7; 7.1 to before 7.1.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* Versions 15.0 – 15.9 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.10 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:8.10:*:*:*:*:macos:*:* Versions 8.10 Vulnerable ·Microsoft
Remediation
- Fix · CNA .NET 5.0 (Microsoft) Fixed in 5.0.9
- Fix · CNA .NET Core 2.1 (Microsoft) Fixed in 2.1.30
- Fix · CNA .NET Core 3.1 (Microsoft) Fixed in 3.1.18
- Fix · CNA Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft) Fixed in 15.9.38
- Fix · CNA Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) (Microsoft) Fixed in 16.10.5
- Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in 16.4.25
- Fix · CNA Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft) Fixed in 16.7.18
- Fix · CNA Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) (Microsoft) Fixed in 16.9.10
- Fix · CNA PowerShell Core 7.0 (Microsoft) Fixed in 7.0.7
- Fix · CNA PowerShell Core 7.1 (Microsoft) Fixed in 7.1.4
- Fix · CNA Visual Studio 2019 for Mac version 8.10 (Microsoft) Fixed in 8.10.7
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-x86 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-arm (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.win-arm (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.osx-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-arm64 (NuGet) Fixed in 5.0.9 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Fixed in 3.1.18 Advisory →
- Fix · GHSA-rh58-r7jh-xhx3 Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Fixed in 5.0.9 Advisory →
Red Hat 4 advisories
- RHSA-2021:3148 Released 2021-08-12 · Red Hat rating Important.NET 5.0 security and bugfix update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-5.0-5.0.9-1.el8_4, aspnetcore-targeting-pack-5.0-5.0.9-1.el8_4, dotnet-5.0.206-1.el8_4 +9
- RHSA-2021:3147 Released 2021-08-12 · Red Hat rating Important.NET 5.0 on RHEL 7 security and bugfix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
- RHSA-2021:3142 Released 2021-08-11 · Red Hat rating Important.NET Core 3.1 security and bugfix update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-3.1-3.1.18-1.el8_4, aspnetcore-targeting-pack-3.1-3.1.18-1.el8_4, dotnet-apphost-pack-3.1-3.1.18-1.el8_4 +6
Show 1 more Red Hat advisories
- RHSA-2021:3143 Released 2021-08-11 · Red Hat rating Important.NET Core 3.1 on RHEL 7 security and bugfix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2021:3143, RHSA-2021:3147 |
| .NET Core on Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3143, RHSA-2021:3147 |
| .NET Core on Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3143, RHSA-2021:3147 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3142, RHSA-2021:3148 |
Not affected: 2 products
- .NET Core 2.1 on Red Hat Enterprise Linux
- Red Hat Enterprise Linux 8
Microsoft
Microsoft's page for this CVE →
- Impact
- Denial of Service
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| .NET 5.0 | Fixed | 5.0.9 · Security Update |
| .NET Core 2.1 | Fixed | 2.1.30 · Security Update |
| .NET Core 3.1 | Fixed | 3.1.18 · Security Update |
| Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | Fixed | 15.9.38 · Security Update |
| Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) | Fixed | 16.10.5 · Security Update |
| Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | Fixed | 16.4.25 · Security Update |
| Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | Fixed | 16.7.18 · Security Update |
| Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | Fixed | 16.9.10 · Security Update |
| PowerShell Core 7.0 | Fixed | 7.0.7 · Security Update |
| PowerShell Core 7.1 | Fixed | 7.1.4 · Security Update |
| Visual Studio 2019 for Mac version 8.10 | Fixed | 8.10.7 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26423
- 2026-10-03 Alias added: GHSA-rh58-r7jh-xhx3
- 2026-10-09 EPSS moved to the 90th–95th percentile
References
Patch 2
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-26423 · CVE Program
- CVE-2021-26423 · NVD
- FIRST EPSS
- GHSA-rh58-r7jh-xhx3 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-26423 · Microsoft Security Update Guide
- CVE-2021-26423 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences