CVE-2020-0602 — Denial of service in ASP.NET Core

Description

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	ASP.NET Core	2.1, 3.0, 3.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	dotnet +4	3.0.102-2.el8_1	RHSA-2020:0130
RHEL 8	dotnet-host +6	3.0.2-2.el8_1	RHSA-2020:0130

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 3	rh-dotnet30-dotnet +3	3.0.102-3.el7	RHSA-2020:0134
Red Hat Rhel Dotnet 3	rh-dotnet30-dotnet-host +6	3.0.2-3.el7	RHSA-2020:0134
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet +3	3.1.101-4.el7	RHSA-2020:0134
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet-host +6	3.1.1-4.el7	RHSA-2020:0134

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	dotnet +3	3.0.102-2.0.1.el8_1	ELSA-2020-0130
Oracle Linux 8	dotnet-host +6	3.0.2-2.0.1.el8_1	ELSA-2020-0130

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.All	>= 2.1.0, < 2.1.15	2.1.15	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App	>= 3.0.0, < 3.0.1	3.0.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App	>= 2.1.0, < 2.1.15	2.1.15	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 3.1.0, < 3.1.1	3.1.1	GHSA-23cv-jh4v-vffm
NuGet	Microsoft.AspNetCore.Http.Connections	>= 1.0.0, < 1.0.15	1.0.15	GHSA-23cv-jh4v-vffm

Advisories 3

RHSA-2020:0130 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
RHSA-2020:0134 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
ELSA-2020-0130 Critical: .NET Core on Red Hat Enterprise Linux security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 20, 2020

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0602
RHSA-2020:0130 vendor-advisory
RHSA-2020:0134 vendor-advisory