Description
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | ASP.NET | ASP.NET Core 1.0, ASP.NET Core 1.1, ASP.NET Core 2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.AspNetCore.Server.HttpSys | >= 2.0.0, < 2.0.2 | 2.0.2 | GHSA-f9jc-rrm2-pmfg |
| NuGet | Microsoft.AspNetCore.Server.WebListener | >= 1.0.0, < 1.0.6 | 1.0.6 | GHSA-f9jc-rrm2-pmfg |
| NuGet | Microsoft.AspNetCore.Server.WebListener | >= 1.1.0, < 1.1.4 | 1.1.4 | GHSA-f9jc-rrm2-pmfg |
| NuGet | Microsoft.Net.Http.Server | >= 1.0.0, < 1.0.6 | 1.0.6 | GHSA-f9jc-rrm2-pmfg |
| NuGet | Microsoft.Net.Http.Server | >= 1.1.0, < 1.1.4 | 1.1.4 | GHSA-f9jc-rrm2-pmfg |