CVE-2021-1721 — .NET Core and Visual Studio Denial of Service Vulnerability

Description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)	16.0.0 – < publication	publication
Microsoft	PowerShell Core 7.1	7.1.0 – < publication	publication
Microsoft	PowerShell Core 7.0	7.0.0 – < publication	publication
Microsoft	.NET Core 2.1	2.1 – < publication	publication
Microsoft	.NET Core 3.1	3.1 – < publication	publication
Microsoft	.NET 5.0	5.0.0 – < publication	publication
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	16.0 – < publication	publication
Microsoft	Microsoft Visual Studio 2019 version 16.8	16.0 – < publication	publication
Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)	15.9.0 – < publication	publication

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	dotnet +2	2.1.521-1.el8_3	RHSA-2021:0476, RHSA-2021:0474
RHEL 8	dotnet-host +6	5.0.3-1.el8_3	RHSA-2021:0476
RHEL 8	dotnet-hostfxr-3.1 +5	3.1.12-1.el8_3	RHSA-2021:0471
RHEL 8	dotnet-runtime-2.1 +1	2.1.25-1.el8_3	RHSA-2021:0474
RHEL 8	dotnet3.1 +2	3.1.112-1.el8_3	RHSA-2021:0471
RHEL 8	dotnet5.0 +3	5.0.103-1.el8_3	RHSA-2021:0476

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet +3	5.0.103-1.el7_9	RHSA-2021:0473
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet-host +6	5.0.3-1.el7_9	RHSA-2021:0473
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet +3	3.1.112-1.el7_9	RHSA-2021:0472
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet-host +6	3.1.12-1.el7_9	RHSA-2021:0472
Red Hat Rhel Dotnet 2	rh-dotnet21 +1	2.1-24.el7_9	RHSA-2021:0470
Red Hat Rhel Dotnet 2	rh-dotnet21-dotnet +2	2.1.521-1.el7_9	RHSA-2021:0470
Red Hat Rhel Dotnet 2	rh-dotnet21-dotnet-host +1	2.1.25-1.el7_9	RHSA-2021:0470

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	dotnet +3	5.0.103-1.0.1.el8_3	ELSA-2021-0476
Oracle Linux 8	dotnet-host +6	5.0.3-1.0.1.el8_3	ELSA-2021-0476
Oracle Linux 8	dotnet-hostfxr-3.1 +5	3.1.12-1.0.1.el8_3	ELSA-2021-0471
Oracle Linux 8	dotnet-runtime-2.1 +1	2.1.25-1.el8_3	ELSA-2021-0474
Oracle Linux 8	dotnet-sdk-2.1 +1	2.1.521-1.el8_3	ELSA-2021-0474
Oracle Linux 8	dotnet-sdk-3.1 +1	3.1.112-1.0.1.el8_3	ELSA-2021-0471

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.NETCore.App	>= 2.1.0, < 2.1.25	2.1.25	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.linux-arm	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.linux-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.linux-musl-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.linux-musl-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.linux-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.osx-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.rhel.6-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.win-arm	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.win-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.win-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Host.win-x86	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.android-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.android-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.android-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.android-x86	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.browser-wasm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.ios-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.ios-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.ios-x86	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.Mono.osx-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.rhel.6-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.tvos-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.tvos-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 3.1.0, < 3.1.12	3.1.12	GHSA-3gp9-h8hw-pxpw
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 5.0.0, < 5.0.3	5.0.3	GHSA-3gp9-h8hw-pxpw

Advisories 9

RHSA-2021:0474 Red Hat Security Advisory: dotnet security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2021:0476 Red Hat Security Advisory: dotnet5.0 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2021:0473 Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2021:0471 Red Hat Security Advisory: dotnet3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2021:0472 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2021:0470 Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
ELSA-2021-0474 Important: dotnet security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 16, 2021
ELSA-2021-0476 Important: dotnet5.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 11, 2021
ELSA-2021-0471 Important: dotnet3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 11, 2021

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721

CNA	v3.1	6.5
EUVD	v3.1	6.5
OSV:GHSA	v3.1	6.5