Read the docs
TI-2023-18092 Aliases CVE-2023-36038

ASP.NET Core Denial of Service Vulnerability

Priority HIGH 69CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

ASP.NET Core Denial of Service Vulnerability

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02777 86th percentileScored 2026-11-07
Fix Fixed ASP.NET Core 8.0 (Microsoft): 8.0.0Microsoft Visual Studio 2022 version 17.2 (Microsoft): 17.2.22+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftASP.NET Core 8.08.0 to before 8.0.08.0.0Patch availableCNA
MicrosoftMicrosoft Visual Studio 2022 version 17.217.2.0 to before 17.2.2217.2.22Patch availableCNA
MicrosoftMicrosoft Visual Studio 2022 version 17.417.4.0 to before 17.4.1417.4.14Patch availableCNA
MicrosoftMicrosoft Visual Studio 2022 version 17.617.6.0 to before 17.6.1017.6.10Patch availableCNA
MicrosoftMicrosoft Visual Studio 2022 version 17.717.7.0 to before 17.7.717.7.7Patch availableCNA
Microsoft.NET 8.08.0 to before 8.0.08.0.0Patch availableCNA
  • ASP.NET Core 8.0 VendorMicrosoft Affected 8.0 to before 8.0.0 Fixed in 8.0.0 Patch available CNA
  • Microsoft Visual Studio 2022 version 17.2 VendorMicrosoft Affected 17.2.0 to before 17.2.22 Fixed in 17.2.22 Patch available CNA
  • Microsoft Visual Studio 2022 version 17.4 VendorMicrosoft Affected 17.4.0 to before 17.4.14 Fixed in 17.4.14 Patch available CNA
  • Microsoft Visual Studio 2022 version 17.6 VendorMicrosoft Affected 17.6.0 to before 17.6.10 Fixed in 17.6.10 Patch available CNA
  • Microsoft Visual Studio 2022 version 17.7 VendorMicrosoft Affected 17.7.0 to before 17.7.7 Fixed in 17.7.7 Patch available CNA
  • .NET 8.0 VendorMicrosoft Affected 8.0 to before 8.0.0 Fixed in 8.0.0 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*17.2 to before 17.2.22; 17.4 to before 17.4.14; 17.6 to before 17.6.10; 17.7 to before 17.7.7VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_core:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.1:*:*:*:*:*:*8.0.0 preview.1Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.2:*:*:*:*:*:*8.0.0 preview.2Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.3:*:*:*:*:*:*8.0.0 preview.3Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.4:*:*:*:*:*:*8.0.0 preview.4Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.5:*:*:*:*:*:*8.0.0 preview.5Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.6:*:*:*:*:*:*8.0.0 preview.6Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:preview.7:*:*:*:*:*:*8.0.0 preview.7Running onMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1Running onMicrosoft
  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.2 to before 17.2.22; 17.4 to before 17.4.14; 17.6 to before 17.6.10; 17.7 to before 17.7.7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_core:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.1:*:*:*:*:*:* Versions 8.0.0 preview.1 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.2:*:*:*:*:*:* Versions 8.0.0 preview.2 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.3:*:*:*:*:*:* Versions 8.0.0 preview.3 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.4:*:*:*:*:*:* Versions 8.0.0 preview.4 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.5:*:*:*:*:*:* Versions 8.0.0 preview.5 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.6:*:*:*:*:*:* Versions 8.0.0 preview.6 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:preview.7:*:*:*:*:*:* Versions 8.0.0 preview.7 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Running on ·Microsoft
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2Running onMicrosoft
  • cpe:2.3:a:microsoft:.net:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Running on ·Microsoft

Remediation

  • Fix · CNA ASP.NET Core 8.0 (Microsoft) Fixed in 8.0.0
  • Fix · CNA Microsoft Visual Studio 2022 version 17.2 (Microsoft) Fixed in 17.2.22
  • Fix · CNA Microsoft Visual Studio 2022 version 17.4 (Microsoft) Fixed in 17.4.14
  • Fix · CNA Microsoft Visual Studio 2022 version 17.6 (Microsoft) Fixed in 17.6.10
  • Fix · CNA Microsoft Visual Studio 2022 version 17.7 (Microsoft) Fixed in 17.7.7
  • Fix · CNA .NET 8.0 (Microsoft) Fixed in 8.0.0

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Denial of Service
Exploited
No
Publicly disclosed
Yes
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
.NET 8.0Fixed 8.0.0 · Security Update
ASP.NET Core 8.0Fixed 8.0.0 · Security Update
Microsoft Visual Studio 2022 version 17.2Fixed 17.2.22 · Security Update
Microsoft Visual Studio 2022 version 17.4Fixed 17.4.14 · Security Update
Microsoft Visual Studio 2022 version 17.6Fixed 17.6.10 · Security Update
Microsoft Visual Studio 2022 version 17.7Fixed 17.7.7 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36038

References

Patch 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2
  • TI-2026-29147 ASP.NET Core Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.1
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences