CVE-2022-29117 — .NET and Visual Studio Denial of Service Vulnerability

Description

.NET and Visual Studio Denial of Service Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	.NET 6.0	6.0.0 – < 6.0.5	6.0.5
Microsoft	.NET Core 3.1	3.1 – < 3.1.25	3.1.25
Microsoft	.NET 5.0	5.0.0 – < 5.0.17	5.0.17
Microsoft	Microsoft Visual Studio 2022 version 17.0	17.0.0 – < 17.0.10	17.0.10
Microsoft	Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)	15.0.0 – < 16.9.21	16.9.21
Microsoft	Microsoft Visual Studio 2022 version 17.1	17.0.0 – < 17.1.7	17.1.7
Microsoft	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)	16.11.0 – < 16.11.14	16.11.14

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	dotnet-host +6	6.0.5-1.el9_0	RHSA-2022:4588
RHEL 9	dotnet6.0 +4	6.0.105-1.el9_0	RHSA-2022:4588
RHEL 8	dotnet +5	6.0.105-1.el8_6	RHSA-2022:2199
RHEL 8	dotnet-host +6	6.0.5-1.el8_6	RHSA-2022:2199
RHEL 8	dotnet-hostfxr-3.1 +5	3.1.25-1.el8_6	RHSA-2022:2202
RHEL 8	dotnet-hostfxr-5.0 +5	5.0.17-1.el8_6	RHSA-2022:2200
RHEL 8	dotnet3.1 +3	3.1.419-1.el8_6	RHSA-2022:2202
RHEL 8	dotnet5.0 +3	5.0.214-1.el8_6	RHSA-2022:2200

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet +4	6.0.105-1.el7_9	RHSA-2022:2195
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet-host +6	6.0.5-1.el7_9	RHSA-2022:2195
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet +4	5.0.214-1.el7_9	RHSA-2022:2196
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet-host +6	5.0.17-1.el7_9	RHSA-2022:2196
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet +4	3.1.419-1.el7_9	RHSA-2022:2194
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet-host +6	3.1.25-1.el7_9	RHSA-2022:2194

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	dotnet +4	6.0.105-1.el8_6	ALSA-2022:2199
AlmaLinux 8	dotnet-host +6	6.0.5-1.el8_6	ALSA-2022:2199
AlmaLinux 8	dotnet-hostfxr-3.1 +5	3.1.25-1.el8_6	ALSA-2022:2202
AlmaLinux 8	dotnet-hostfxr-5.0 +5	5.0.17-1.el8_6	ALSA-2022:2200
AlmaLinux 8	dotnet-sdk-3.1 +2	3.1.419-1.el8_6	ALSA-2022:2202
AlmaLinux 8	dotnet-sdk-5.0 +2	5.0.214-1.el8_6	ALSA-2022:2200

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	dotnet3.1	3.1.419-1.el8_6	RLSA-2022:2202
Rocky Linux 8	dotnet5.0	5.0.214-1.el8_6	RLSA-2022:2200
Rocky Linux 8	dotnet6.0	6.0.105-1.el8_6	RLSA-2022:2199

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	dotnet-host +6	6.0.5-1.0.1.el9_0	ELSA-2022-4588
Oracle Linux 9	dotnet-sdk-6.0 +3	6.0.105-1.0.1.el9_0	ELSA-2022-4588
Oracle Linux 8	dotnet +3	6.0.105-1.0.1.el8_6	ELSA-2022-2199
Oracle Linux 8	dotnet-host +6	6.0.5-1.0.1.el8_6	ELSA-2022-2199
Oracle Linux 8	dotnet-hostfxr-3.1 +5	3.1.25-1.0.1.el8_6	ELSA-2022-2202
Oracle Linux 8	dotnet-hostfxr-5.0 +5	5.0.17-1.0.1.el8_6	ELSA-2022-2200
Oracle Linux 8	dotnet-sdk-3.1 +2	3.1.419-1.0.1.el8_6	ELSA-2022-2202
Oracle Linux 8	dotnet-sdk-5.0 +1	5.0.214-1.0.1.el8_6	ELSA-2022-2200

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

CharanMv08/cve-2022-29117-assessment ★ 0 · Aug 31, 2026

CVE-2022-29117 (.NET Cookie-Handling DoS) Assessment, Understanding & Questions Framework

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 3.0.0, < 3.1.25	3.1.25	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 5.0.0, < 5.0.17	5.0.17	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 6.0.0, < 6.0.5	6.0.5	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.Owin	< 4.2.2	4.2.2	GHSA-3rq8-h3gj-r5c6
NuGet	Microsoft.Owin.Security.Cookies	< 4.2.2	4.2.2	GHSA-3rq8-h3gj-r5c6

Advisories 18

ALSA-2022:2202 Important: .NET Core 3.1 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:2200 Important: .NET 5.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:2199 Important: .NET 6.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:2200 Red Hat Security Advisory: .NET 5.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:2202 Red Hat Security Advisory: .NET Core 3.1 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:4588 Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:2199 Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:2195 Red Hat Security Advisory: .NET 6.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Feb 26, 2026
RHSA-2022:2196 Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Feb 26, 2026
RHSA-2022:2194 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Feb 26, 2026
RLSA-2022:2202 Important: .NET Core 3.1 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2022:2199 Important: .NET 6.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2022:2200 Important: .NET 5.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
ELSA-2022-4588 Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 30, 2022
ELSA-2022-2202 Important: .NET Core 3.1 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 19, 2022
ELSA-2022-2200 Important: .NET 5.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 19, 2022
ELSA-2022-2199 Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 19, 2022
MSRC-CVE-2022-29117 .NET and Visual Studio Denial of Service Vulnerability Microsoft Security Response Center · May 10, 2022

References

.NET and Visual Studio Denial of Service Vulnerability vendor-advisory

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5