GHSA-242j-2gm6-5rwxHighCVSS 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Published
May 24, 2022
Last Modified
October 9, 2024

🔗 CVE IDs covered (1)

CVE-2021-1723 →

📋 Description

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.

🎯 Affected products22

  • nuget/Microsoft.AspNetCore.Server.Kestrel.Core:< 2.1.25
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-arm:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-arm:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-x64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-x64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.osx-x64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.osx-x64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.win-arm:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.win-arm:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.win-arm64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.win-arm64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.win-x64:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.win-x64:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.win-x86:>= 3.1.0, < 3.1.11
  • nuget/Microsoft.AspNetCore.App.Runtime.win-x86:>= 5.0.0, < 5.0.2
  • nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm:= 5.0.1

🔗 References (6)