MSRC-CVE-2024-38095 — .NET and Visual Studio Denial of Service Vulnerability

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

2024-10-08 #3
In the Security Updates table, added .NET 6.0 as it is also affected by this vulnerability. Note that there is no security update for .NET 6.0 to address this vulnerablity. HTTP/3 support was only experimental in .NET 6.0, so if you are using .NET 6 you must update your application to .NET 8 to be protected.
2024-07-25 #2
Revised the Security Updates table to include PowerShell 7.4 and 7.2 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/64](https://github.com/PowerShell/Announcements/issues/64) for more information.
2024-07-09 #1
Information published.

CVE-2024-38095 .NET and Visual Studio Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38095
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss