Description
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application.
The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET 5.0 | 5.0.0 – < publication | publication |
| Microsoft | .NET Core 2.1 | 2.1 – < publication | publication |
| Microsoft | .NET Core 3.1 | 3.1 – < publication | publication |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.0 Service Pack 2 | 3.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 | 3.5.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 | 3.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 4.5.2 | 4.0.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 4.6 | 4.0.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | 4.0.0.0 – < publication | publication |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.0 | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.5 | 16.0 – < publication | publication |
| Microsoft | PowerShell 7.0 | 7.0.0 – < publication | publication |
| Microsoft | PowerShell Core 6.2 | 6.0 – < publication | publication |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +2 | 2.1.514-2.el8_2 | RHSA-2020:2471, RHSA-2020:2450, RHSA-2020:2250 |
| RHEL 8 | dotnet-host +6 | 3.1.4-2.el8_2 | RHSA-2020:2450, RHSA-2020:2250 |
| RHEL 8 | dotnet-runtime-2.1 +1 | 2.1.18-2.el8_2 | RHSA-2020:2471, RHSA-2020:2143 |
| RHEL 8 | dotnet3.1 +3 | 3.1.104-2.el8_2 | RHSA-2020:2450, RHSA-2020:2250 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.104-2.el7 | RHSA-2020:2475, RHSA-2020:2249 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.4-2.el7 | RHSA-2020:2475, RHSA-2020:2249 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21 +1 | 2.1-17.el7 | RHSA-2020:2476, RHSA-2020:2146 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet +2 | 2.1.514-2.el7 | RHSA-2020:2476, RHSA-2020:2146 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet-host +1 | 2.1.18-2.el7 | RHSA-2020:2476, RHSA-2020:2146 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 3.1.104-2.0.2.el8_2 | ELSA-2020-2450, ELSA-2020-2250 |
| Oracle Linux 8 | dotnet-host +6 | 3.1.4-2.0.2.el8_2 | ELSA-2020-2450, ELSA-2020-2250 |
| Oracle Linux 8 | dotnet-runtime-2.1 +1 | 2.1.18-2.el8_2 | ELSA-2020-2471, ELSA-2020-2143 |
| Oracle Linux 8 | dotnet-sdk-2.1 +1 | 2.1.514-2.el8_2 | ELSA-2020-2471, ELSA-2020-2143 |
Affected packages
Advisories 12
- RHSA-2020:2476 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 7 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2475 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 7 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2450 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux 8 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2471 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 8 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2249 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2250 Red Hat Security Advisory: dotnet3.1 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2146 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2143 Red Hat Security Advisory: .NET Core security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- ELSA-2020-2471 Important: .NET Core on Red Hat Enterprise Linux 8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 12, 2020
- ELSA-2020-2450 Important: .NET Core 3.1 on Red Hat Enterprise Linux 8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 11, 2020
- ELSA-2020-2250 Important: dotnet3.1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 9, 2020
- ELSA-2020-2143 Important: .NET Core security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 13, 2020
References
- .NET Core & .NET Framework Denial of Service Vulnerability vendor-advisory patch