Description
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Framework and .NET Core | Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet +2 | 2.0.5-1.el7 | RHSA-2018:0379 |
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet-sdk-2.1 | 2.1.4-1.el7 | RHSA-2018:0379 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore10-dotnetcore | 1.0.9-1.el7 | RHSA-2018:0379 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore11-dotnetcore | 1.1.6-1.el7 | RHSA-2018:0379 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | System.Security.Cryptography.Xml | < 4.4.2 | 4.4.2 | GHSA-rr3c-f55v-qhv5 |
Advisories 1
- RHSA-2018:0379 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 102387 vdb-entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0764
- RHSA-2018:0379 vendor-advisory
- 1040152 vdb-entry