MSRC-CVE-2022-21986 — .NET Denial of Service Vulnerability

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What .NET component is affected by this denial of service vulnerability?
This vulnerability affects applications that utilize the Kestrel web server when processing certain HTTP/2 and HTTP/3 requests.

Security updates
16.9.17 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.9
16.11.10 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
17.0.6 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
8.10.18 — https://docs.microsoft.com/visualstudio/releasenotes/vs2019-mac-relnotes
5.0.14 — https://github.com/dotnet/announcements/issues/208

Vulnerabilities 1

High 7.5

CVE-2022-21986

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) .NET 6.0 Microsoft Visual Studio 2022 version 17.0 NuGet

Feb 9, 2022

Revision history

2022-02-08 #1
Information published.

References

CVE-2022-21986 .NET Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21986
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss