Description
Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 | Microsoft .NET Framework | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet +3 | 2.0.3-4.el7 | RHSA-2017:3248 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore10-dotnetcore | 1.0.8-1.el7 | RHSA-2017:3248 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore11-dotnetcore | 1.1.5-1.el7 | RHSA-2017:3248 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.NETCore.App | >= 1.0.0, < 1.0.7 | 1.0.7 | GHSA-8884-xcr4-r68p |
| NuGet | Microsoft.NETCore.App | >= 1.1.0, < 1.1.4 | 1.1.4 | GHSA-8884-xcr4-r68p |
Advisories 1
- RHSA-2017:3248 Red Hat Security Advisory: .NET Core security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 1038864 vdb-entry
- 99432 vdb-entry
- RHSA-2017:3248 vendor-advisory
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8585