Description
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | ASP.NET Core 3.1 | 3.0 – < publication | publication |
| Microsoft | ASP.NET Core 5.0 | 5.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.8 | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 – < publication | publication |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +4 | 5.0.102-2.el8_3 | RHSA-2021:0094 |
| RHEL 8 | dotnet-host +6 | 5.0.2-2.el8_3 | RHSA-2021:0094 |
| RHEL 8 | dotnet-hostfxr-3.1 +5 | 3.1.11-1.el8_3 | RHSA-2021:0095 |
| RHEL 8 | dotnet3.1 +2 | 3.1.111-1.el8_3 | RHSA-2021:0095 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet +3 | 5.0.102-1.el7_9 | RHSA-2021:0096 |
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet-host +6 | 5.0.2-1.el7_9 | RHSA-2021:0096 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.111-1.el7_9 | RHSA-2021:0114 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.11-1.el7_9 | RHSA-2021:0114 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 5.0.102-2.0.1.el8_3 | ELSA-2021-0094 |
| Oracle Linux 8 | dotnet-host +6 | 5.0.2-2.0.1.el8_3 | ELSA-2021-0094 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 +5 | 3.1.11-1.0.1.el8_3 | ELSA-2021-0095 |
| Oracle Linux 8 | dotnet-sdk-3.1 +1 | 3.1.111-1.0.1.el8_3 | ELSA-2021-0095 |
Affected packages
Advisories 6
- RHSA-2021:0096 Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:0114 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:0095 Red Hat Security Advisory: dotnet3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:0094 Red Hat Security Advisory: dotnet5.0 security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2021-0094 Important: dotnet5.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 15, 2021
- ELSA-2021-0095 Important: dotnet3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 15, 2021
References
- ASP.NET Core and Visual Studio Denial of Service Vulnerability vendor-advisory