TI-2021-13554 Aliases CVE-2021-34532 GHSA-q7cg-43mg-qp69

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

LOW 27Published 2021-08-12 · Updated 2026-11-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from Microsoft.

Summary

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01219 68th percentileScored 2026-11-07

Fix Fixed ASP.NET Core 2.1 (Microsoft): 2.1.29ASP.NET Core 3.1 (Microsoft): 3.1.18+7 more productsRed Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	ASP.NET Core 2.1	2.0 to before 2.1.29	2.1.29	Patch available	CNA
Microsoft	ASP.NET Core 3.1	3.0 to before 3.1.18	3.1.18	Patch available	CNA
Microsoft	ASP.NET Core 5.0	5.0 to before 5.0.9	5.0.9	Patch available	CNA
Microsoft	Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9)	16.10.0 to before 16.10.5	16.10.5	Patch available	CNA
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	16.0 to before 16.4.25	16.4.25	Patch available	CNA
Microsoft	Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)	16.0.0 to before 16.7.18	16.7.18	Patch available	CNA
Microsoft	Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)	15.0.0 to before 16.9.10	16.9.10	Patch available	CNA
Microsoft	Visual Studio 2019 for Mac version 8.10	8.1.0 to before 8.10.7	8.10.7	Patch available	CNA
—	Microsoft.AspNetCore.Authentication.JwtBearer (NuGet)	2.1.0 to before 2.1.29	2.1.29	Patch available	GHSA-q7cg-43mg-qp69
—	Microsoft.AspNetCore.Authentication.JwtBearer (NuGet)	3.0.0 to before 3.1.18	3.1.18	Patch available	GHSA-q7cg-43mg-qp69
—	Microsoft.AspNetCore.Authentication.JwtBearer (NuGet)	5.0.0 to before 5.0.9	5.0.9	Patch available	GHSA-q7cg-43mg-qp69

ASP.NET Core 2.1 VendorMicrosoft Affected 2.0 to before 2.1.29 Fixed in 2.1.29 Patch available CNA
ASP.NET Core 3.1 VendorMicrosoft Affected 3.0 to before 3.1.18 Fixed in 3.1.18 Patch available CNA
ASP.NET Core 5.0 VendorMicrosoft Affected 5.0 to before 5.0.9 Fixed in 5.0.9 Patch available CNA
Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) VendorMicrosoft Affected 16.10.0 to before 16.10.5 Fixed in 16.10.5 Patch available CNA
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before 16.4.25 Fixed in 16.4.25 Patch available CNA
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) VendorMicrosoft Affected 16.0.0 to before 16.7.18 Fixed in 16.7.18 Patch available CNA
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) VendorMicrosoft Affected 15.0.0 to before 16.9.10 Fixed in 16.9.10 Patch available CNA
Visual Studio 2019 for Mac version 8.10 VendorMicrosoft Affected 8.1.0 to before 8.10.7 Fixed in 8.10.7 Patch available CNA
Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Vendor— Affected 2.1.0 to before 2.1.29 Fixed in 2.1.29 Patch available GHSA-q7cg-43mg-qp69
Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Vendor— Affected 3.0.0 to before 3.1.18 Fixed in 3.1.18 Patch available GHSA-q7cg-43mg-qp69
Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-q7cg-43mg-qp69

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:asp.net_core::::::::	2.1 – 2.1.2; 3.1 – 3.1.17; 5.0 – 5.0.8	Vulnerable	Microsoft
cpe:2.3:a:microsoft:visual_studio_2019::::::::	16.0 – 16.10	Vulnerable	Microsoft
cpe:2.3:a:microsoft:visual_studio_2019:8.10:::::macos::	8.10	Vulnerable	Microsoft

cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* Versions 2.1 – 2.1.2; 3.1 – 3.1.17; 5.0 – 5.0.8 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.10 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:visual_studio_2019:8.10:*:*:*:*:macos:*:* Versions 8.10 Vulnerable ·Microsoft

Remediation

Fix · CNA ASP.NET Core 2.1 (Microsoft) Fixed in 2.1.29
Fix · CNA ASP.NET Core 3.1 (Microsoft) Fixed in 3.1.18
Fix · CNA ASP.NET Core 5.0 (Microsoft) Fixed in 5.0.9
Fix · CNA Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) (Microsoft) Fixed in 16.10.5
Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in 16.4.25
Fix · CNA Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft) Fixed in 16.7.18
Fix · CNA Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) (Microsoft) Fixed in 16.9.10
Fix · CNA Visual Studio 2019 for Mac version 8.10 (Microsoft) Fixed in 8.10.7
Fix · GHSA-q7cg-43mg-qp69 Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Fixed in 2.1.29 Advisory →
Fix · GHSA-q7cg-43mg-qp69 Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Fixed in 3.1.18 Advisory →
Fix · GHSA-q7cg-43mg-qp69 Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) Fixed in 5.0.9 Advisory →

Red Hat 4 advisories

RHSA-2021:3148 Released 2021-08-12 · Red Hat rating Important
.NET 5.0 security and bugfix update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-5.0-5.0.9-1.el8_4, aspnetcore-targeting-pack-5.0-5.0.9-1.el8_4, dotnet-5.0.206-1.el8_4 +9
RHSA-2021:3147 Released 2021-08-12 · Red Hat rating Important
.NET 5.0 on RHEL 7 security and bugfix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.9-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.9-1.el7_9, rh-dotnet50-dotnet-5.0.206-1.el7_9 +8
RHSA-2021:3142 Released 2021-08-11 · Red Hat rating Important
.NET Core 3.1 security and bugfix update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-3.1-3.1.18-1.el8_4, aspnetcore-targeting-pack-3.1-3.1.18-1.el8_4, dotnet-apphost-pack-3.1-3.1.18-1.el8_4 +6

Show 1 more Red Hat advisories

RHSA-2021:3143 Released 2021-08-11 · Red Hat rating Important
.NET Core 3.1 on RHEL 7 security and bugfix update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-aspnetcore-runtime-3.1-3.1.18-1.el7_9, rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.18-1.el7_9, rh-dotnet31-dotnet-3.1.118-1.el7_9 +8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2021:3143, RHSA-2021:3147
.NET Core on Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2021:3143, RHSA-2021:3147
.NET Core on Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2021:3143, RHSA-2021:3147
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2021:3142, RHSA-2021:3148

Not affected: 2 products

.NET Core 2.1 on Red Hat Enterprise Linux
Red Hat Enterprise Linux 8

Microsoft

Microsoft's page for this CVE →

Impact: Information Disclosure
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely

Product	Status	Plan or fix
ASP.NET Core 2.1	Fixed	2.1.29 · Security Update
ASP.NET Core 3.1	Fixed	3.1.18 · Security Update
ASP.NET Core 5.0	Fixed	5.0.9 · Security Update
Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9)	Fixed	16.10.5 · Security Update
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	Fixed	16.4.25 · Security Update
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)	Fixed	16.7.18 · Security Update
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)	Fixed	16.9.10 · Security Update
Visual Studio 2019 for Mac version 8.10	Fixed	8.10.7 · Security Update

Timeline

2026-10-02 Threatist record created from CVE-2021-34532
2026-10-03 Alias added: GHSA-q7cg-43mg-qp69
2026-11-02 CISA SSVC decision points changed

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-34532

Other 2

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Key facts

Summary

Why it matters now

SSVC decision points

Affected products

CPE configurations NVD · 3

Remediation

Red Hat 4 advisories

Vendor assessments

Red Hat

Microsoft

Timeline

References

Patch 2

Advisory 1

Other 2

More Microsoft Asp.net Core vulnerabilities

Sources