Description
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application.
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | ASP.NET Core 3.1 | 3.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.0 | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.5 | 16.0 – < publication | publication |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +4 | 3.1.104-2.el8_2 | RHSA-2020:2250 |
| RHEL 8 | dotnet-host +6 | 3.1.4-2.el8_2 | RHSA-2020:2250 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.104-2.el7 | RHSA-2020:2249 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.4-2.el7 | RHSA-2020:2249 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 3.1.104-2.0.2.el8_2 | ELSA-2020-2250 |
| Oracle Linux 8 | dotnet-host +6 | 3.1.4-2.0.2.el8_2 | ELSA-2020-2250 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-arm | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x64 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x86 | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-3cf7-7wq6-8842 |
Advisories 3
- RHSA-2020:2249 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:2250 Red Hat Security Advisory: dotnet3.1 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- ELSA-2020-2250 Important: dotnet3.1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 9, 2020
References
- ASP.NET Core Denial of Service Vulnerability vendor-advisory patch