Why does GHSA-3m2r-q8x3-xmf7 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-3m2r-q8x3-xmf7?

GHSA-3m2r-q8x3-xmf7 affects 4 products, including: nuget/Microsoft.AspNetCore.Server.Kestrel.Core:\u003e= 2.0.0, \u003c 2.0.3; nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions:\u003e= 2.0.0, \u003c 2.0.3; nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv:\u003e= 2.0.0, \u003c 2.0.3; nuget/Microsoft.AspNetCore.All:\u003e= 2.0.0, \u003c 2.0.8.

GHSA-3m2r-q8x3-xmf7MediumDisclosed before NVD

Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

Vendor

GitHub Security Advisories

Published

October 16, 2018

Last Modified

January 9, 2023

📋 Description

Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

🎯 Affected products4

nuget/Microsoft.AspNetCore.Server.Kestrel.Core:>= 2.0.0, < 2.0.3
nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions:>= 2.0.0, < 2.0.3
nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv:>= 2.0.0, < 2.0.3
nuget/Microsoft.AspNetCore.All:>= 2.0.0, < 2.0.8

🔗 References (2)

https://github.com/aspnet/Announcements/issues/300
https://github.com/advisories/GHSA-3m2r-q8x3-xmf7