Description
.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Core | .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability". | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet +2 | 2.0.6-1.el7 | RHSA-2018:0522 |
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet-sdk-2.1 | 2.1.101-1.el7 | RHSA-2018:0522 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore10-dotnetcore | 1.0.10-1.el7 | RHSA-2018:0522 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore11-dotnetcore | 1.1.7-1.el7 | RHSA-2018:0522 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.NETCore.Jit | >= 2.0.0, < 2.0.6 | 2.0.6 | GHSA-xcvr-qv8h-m7xw |
| NuGet | Microsoft.NETCore.Jit | >= 1.1.0, < 1.1.7 | 1.1.7 | GHSA-xcvr-qv8h-m7xw |
| NuGet | Microsoft.NETCore.Jit | < 1.0.12 | 1.0.12 | GHSA-xcvr-qv8h-m7xw |
Advisories 1
- RHSA-2018:0522 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875
- 103225 vdb-entry
- 1040505 vdb-entry
- RHSA-2018:0522 vendor-advisory