Read the docs
TI-2021-18179 Aliases CVE-2021-41355GHSA-9cxh-gqpx-qc5m

.NET Core and Visual Studio Information Disclosure Vulnerability

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

.NET Core and Visual Studio Information Disclosure Vulnerability

Why it matters now

EPSS 0.20342 97th percentileScored 2026-11-07
Fix Fixed PowerShell 7.1 (Microsoft): 7.1.5Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) (Microsoft): 16.9.12+3 more productsRed Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftPowerShell 7.17.1.0 to before 7.1.57.1.5Patch availableCNA
MicrosoftMicrosoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)15.0.0 to before 16.9.1216.9.12Patch availableCNA
MicrosoftMicrosoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)16.11.0 to before 16.11.516.11.5Patch availableCNA
Microsoft.NET 5.05.0.0 to before 5.0.115.0.11Patch availableCNA
—System.DirectoryServices.Protocols (NuGet)before 5.0.15.0.1Patch availableGHSA-9cxh-gqpx-qc5m
  • PowerShell 7.1 VendorMicrosoft Affected 7.1.0 to before 7.1.5 Fixed in 7.1.5 Patch available CNA
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) VendorMicrosoft Affected 15.0.0 to before 16.9.12 Fixed in 16.9.12 Patch available CNA
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) VendorMicrosoft Affected 16.11.0 to before 16.11.5 Fixed in 16.11.5 Patch available CNA
  • .NET 5.0 VendorMicrosoft Affected 5.0.0 to before 5.0.11 Fixed in 5.0.11 Patch available CNA
  • System.DirectoryServices.Protocols (NuGet) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-9cxh-gqpx-qc5m

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net:5.0:*:*:*:*:*:*:*5.0VulnerableMicrosoft
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*7.1 to before 7.1.5VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*16.0 – 16.11VulnerableMicrosoft
  • cpe:2.3:a:microsoft:.net:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:* Versions 7.1 to before 7.1.5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.11 Vulnerable ·Microsoft

Remediation

  • Fix · CNA PowerShell 7.1 (Microsoft) Fixed in 7.1.5
  • Fix · CNA Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) (Microsoft) Fixed in 16.9.12
  • Fix · CNA Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) (Microsoft) Fixed in 16.11.5
  • Fix · CNA .NET 5.0 (Microsoft) Fixed in 5.0.11
  • Fix · GHSA-9cxh-gqpx-qc5m System.DirectoryServices.Protocols (NuGet) Fixed in 5.0.1 Advisory →

Red Hat 2 advisories

  • RHSA-2021:3819 Released 2021-10-12 · Red Hat rating Important
    .NET 5.0 security and bugfix update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-5.0-5.0.11-1.el8_4, aspnetcore-targeting-pack-5.0-5.0.11-1.el8_4, dotnet-5.0.208-1.el8_4 +9
  • RHSA-2021:3818 Released 2021-10-12 · Red Hat rating Important
    .NET 5.0 on RHEL 7 security and bugfix update
    • .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.11-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.11-1.el7_9, rh-dotnet50-dotnet-5.0.208-1.el7_9 +9
    • .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.11-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.11-1.el7_9, rh-dotnet50-dotnet-5.0.208-1.el7_9 +9
    • .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet50-aspnetcore-runtime-5.0-5.0.11-1.el7_9, rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.11-1.el7_9, rh-dotnet50-dotnet-5.0.208-1.el7_9 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2021:3818
.NET Core on Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3818
.NET Core on Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3818
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3819
Not affected: 3 products
  • .NET Core 3.1 on Red Hat Enterprise Linux
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41355
  2. 2026-10-03 Alias added: GHSA-9cxh-gqpx-qc5m

References

Patch 1

Advisory 2

Other 4

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences