CVE-2022-38013 — .NET Core and Visual Studio Denial of Service Vulnerability

Description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Visual Studio 2022 for Mac version 17.3	17.3 – < 17.3.5	17.3.5
Microsoft	Microsoft Visual Studio 2022 version 17.3	17.0.0 – < 17.3.4	17.3.4
Microsoft	.NET Core 3.1	3.1 – < 3.1.29	3.1.29
Microsoft	.NET 6.0	6.0.0 – < 6.0.9	6.0.9
Microsoft	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)	16.11.0 – < 16.11.19	16.11.19
Microsoft	Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)	15.0.0 – < 16.9.25	16.9.25
Microsoft	Microsoft Visual Studio 2022 version 17.0	17.0.0 – < 17.0.14	17.0.14
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0 – < 17.2.8	17.2.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	dotnet6	6.0.109-0ubuntu1~22.04.1	USN-5609-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	dotnet-host +6	6.0.9-1.el9_0	RHSA-2022:6521
RHEL 9	dotnet6.0 +4	6.0.109-1.el9_0	RHSA-2022:6521
RHEL 8	dotnet +5	6.0.109-1.el8_6	RHSA-2022:6539
RHEL 8	dotnet-host +6	6.0.9-1.el8_6	RHSA-2022:6539
RHEL 8	dotnet-hostfxr-3.1 +5	3.1.29-1.el8_6	RHSA-2022:6523
RHEL 8	dotnet3.1 +3	3.1.423-1.el8_6	RHSA-2022:6523

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet +4	6.0.109-1.el7_9	RHSA-2022:6520
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet-host +6	6.0.9-1.el7_9	RHSA-2022:6520
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet +4	3.1.423-1.el7_9	RHSA-2022:6522
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet-host +6	3.1.29-1.el7_9	RHSA-2022:6522

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	dotnet-host +6	6.0.9-1.el9_0	ALSA-2022:6521
AlmaLinux 9	dotnet-sdk-6.0 +3	6.0.109-1.el9_0	ALSA-2022:6521
AlmaLinux 8	dotnet +4	6.0.109-1.el8_6	ALSA-2022:6539
AlmaLinux 8	dotnet-host +6	6.0.9-1.el8_6	ALSA-2022:6539
AlmaLinux 8	dotnet-hostfxr-3.1 +5	3.1.29-1.el8_6	ALSA-2022:6523
AlmaLinux 8	dotnet-sdk-3.1 +2	3.1.423-1.el8_6	ALSA-2022:6523

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	dotnet3.1	3.1.423-1.el8_6	RLSA-2022:6523
Rocky Linux 8	dotnet6.0	6.0.109-1.el8_6	RLSA-2022:6539

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.20	dotnet6-build	6.0.109-r0	—
Alpine v3.20	dotnet6-runtime	6.0.9-r0	—
Alpine v3.19	dotnet6-build	6.0.109-r0	—
Alpine v3.19	dotnet6-runtime	6.0.9-r0	—
Alpine v3.18	dotnet6-build	6.0.109-r0	—
Alpine v3.18	dotnet6-runtime	6.0.9-r0	—
Alpine v3.17	dotnet6-build	6.0.109-r0	—
Alpine v3.17	dotnet6-runtime	6.0.9-r0	—
Alpine v3.16	dotnet6-build	6.0.109-r0	—
Alpine v3.16	dotnet6-runtime	6.0.9-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	dotnet +4	6.0.111-1.amzn2023.0.2	ALAS2023-2023-092
Amazon Linux 2023	dotnet-host +6	6.0.11-1.amzn2023.0.2	ALAS2023-2023-092

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	dotnet-host +6	6.0.9-1.0.1.el9_0	ELSA-2022-6521
Oracle Linux 9	dotnet-sdk-6.0 +3	6.0.109-1.0.1.el9_0	ELSA-2022-6521
Oracle Linux 8	dotnet +4	6.0.109-1.0.1.el8_6	ELSA-2022-6539
Oracle Linux 8	dotnet-host +6	6.0.9-1.0.1.el8_6	ELSA-2022-6539
Oracle Linux 8	dotnet-hostfxr-3.1 +5	3.1.29-1.0.1.el8_6	ELSA-2022-6523
Oracle Linux 8	dotnet-sdk-3.1 +2	3.1.423-1.0.1.el8_6	ELSA-2022-6523

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 3.1.0, < 3.1.29	3.1.29	GHSA-r8m2-4x37-6592
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 5.0.0, < 6.0.9	6.0.9	GHSA-r8m2-4x37-6592

Advisories 17

ALSA-2022:6521 Moderate: .NET 6.0 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:6539 Moderate: .NET 6.0 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:6523 Moderate: .NET Core 3.1 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:6521 Red Hat Security Advisory: .NET 6.0 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6539 Red Hat Security Advisory: .NET 6.0 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6523 Red Hat Security Advisory: .NET Core 3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
USN-5609-1 dotnet6 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
RLSA-2022:6523 Moderate: .NET Core 3.1 security and bugfix update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2022:6539 Moderate: .NET 6.0 security and bugfix update Rocky Linux Security Advisories · Feb 4, 2026
RHSA-2022:6520 Red Hat Security Advisory: .NET 6.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Jan 14, 2026
RHSA-2022:6522 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Jan 14, 2026
ALAS2023-2023-092 Important: dotnet6.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
WID-SEC-2022-1403 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2022
ELSA-2022-6539 Moderate: .NET 6.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 15, 2022
ELSA-2022-6523 Moderate: .NET Core 3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 15, 2022
ELSA-2022-6521 Moderate: .NET 6.0 security and bugfix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 14, 2022
MSRC-CVE-2022-38013 .NET Core and Visual Studio Denial of Service Vulnerability Microsoft Security Response Center · Sep 13, 2022

References

.NET Core and Visual Studio Denial of Service Vulnerability vendor-advisory

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5