Description
.NET Core and Visual Studio Denial of Service Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET 5.0 | 5.0.0 – < 5.0.9 | 5.0.9 |
| Microsoft | .NET Core 2.1 | 2.1 – < 2.1.30 | 2.1.30 |
| Microsoft | .NET Core 3.1 | 3.1 – < 3.1.18 | 3.1.18 |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 – < 15.9.38 | 15.9.38 |
| Microsoft | Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) | 16.10.0 – < 16.10.5 | 16.10.5 |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < 16.4.25 | 16.4.25 |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 – < 16.7.18 | 16.7.18 |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – < 16.9.10 | 16.9.10 |
| Microsoft | PowerShell Core 7.0 | 7.0.0 – < 7.0.7 | 7.0.7 |
| Microsoft | PowerShell Core 7.1 | 7.1.0 – < 7.1.4 | 7.1.4 |
| Microsoft | Visual Studio 2019 for Mac version 8.10 | 8.1.0 – < 8.10.7 | 8.10.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +4 | 5.0.206-1.el8_4 | RHSA-2021:3148 |
| RHEL 8 | dotnet-host +6 | 5.0.9-1.el8_4 | RHSA-2021:3148 |
| RHEL 8 | dotnet-hostfxr-3.1 +5 | 3.1.18-1.el8_4 | RHSA-2021:3142 |
| RHEL 8 | dotnet3.1 +2 | 3.1.118-1.el8_4 | RHSA-2021:3142 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet +3 | 5.0.206-1.el7_9 | RHSA-2021:3147 |
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet-host +6 | 5.0.9-1.el7_9 | RHSA-2021:3147 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.118-1.el7_9 | RHSA-2021:3143 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.18-1.el7_9 | RHSA-2021:3143 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 5.0.206-1.0.1.el8_4 | ELSA-2021-3148 |
| Oracle Linux 8 | dotnet-host +6 | 5.0.9-1.0.1.el8_4 | ELSA-2021-3148 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 +5 | 3.1.18-1.0.1.el8_4 | ELSA-2021-3142 |
| Oracle Linux 8 | dotnet-sdk-3.1 +1 | 3.1.118-1.0.1.el8_4 | ELSA-2021-3142 |
Affected packages
Advisories 7
- RHSA-2021:3148 Red Hat Security Advisory: .NET 5.0 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:3147 Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:3143 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:3142 Red Hat Security Advisory: .NET Core 3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- MSRC-CVE-2021-26423 .NET Core and Visual Studio Denial of Service Vulnerability Microsoft Security Response Center · Aug 19, 2021
- ELSA-2021-3142 Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2021
- ELSA-2021-3148 Important: .NET 5.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2021
References
- .NET Core and Visual Studio Denial of Service Vulnerability vendor-advisory patch