CVE-2024-21386 — .NET Denial of Service Vulnerability

Description

.NET Denial of Service Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	ASP.NET Core 6.0	6.0 – < 6.0.27	6.0.27
Microsoft	ASP.NET Core 7.0	7.0.0 – < 7.0.16	7.0.16
Microsoft	ASP.NET Core 8.0	8.0 – < 8.0.2	8.0.2
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 – < 17.4.16	17.4.16
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 – < 17.6.12	17.6.12
Microsoft	Microsoft Visual Studio 2022 version 17.8	17.8.0 – < 17.8.7	17.8.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	dotnet6	6.0.127-0ubuntu1~22.04.1	USN-6634-1
Ubuntu 22.04 LTS	dotnet7	7.0.116-0ubuntu1~22.04.1	USN-6634-1
Ubuntu 22.04 LTS	dotnet8	8.0.102-8.0.2-0ubuntu1~22.04.1	USN-6634-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	dotnet-host +8	8.0.2-2.el9_3	RHSA-2024:0848
RHEL 9	dotnet-hostfxr-6.0 +5	6.0.27-1.el9_3	RHSA-2024:0807
RHEL 9	dotnet-hostfxr-7.0 +5	7.0.16-1.el9_3	RHSA-2024:2843, RHSA-2024:0805
RHEL 9	dotnet6.0 +3	6.0.127-1.el9_3	RHSA-2024:0807
RHEL 9	dotnet7.0 +3	7.0.116-1.el9_3	RHSA-2024:2843, RHSA-2024:0805
RHEL 9	dotnet8.0 +5	8.0.102-2.el9_3	RHSA-2024:0848
RHEL 8	dotnet +6	8.0.102-2.el8_9	RHSA-2024:0827
RHEL 8	dotnet-host +8	8.0.2-2.el8_9	RHSA-2024:0827
RHEL 8	dotnet-hostfxr-6.0 +5	6.0.27-1.el8_9	RHSA-2024:0808
RHEL 8	dotnet-hostfxr-7.0 +5	7.0.16-1.el8_9	RHSA-2024:3340, RHSA-2024:0806
RHEL 8	dotnet6.0 +3	6.0.127-1.el8_9	RHSA-2024:0808
RHEL 8	dotnet7.0 +3	7.0.116-1.el8_9	RHSA-2024:3340, RHSA-2024:0806

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet +4	6.0.127-1.el7_9	RHSA-2024:0814
Red Hat Rhel Dotnet 6	rh-dotnet60-dotnet-host +6	6.0.27-1.el7_9	RHSA-2024:0814

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	dotnet-host +8	8.0.2-2.el9_3	ALSA-2024:0848
AlmaLinux 9	dotnet-hostfxr-6.0 +5	6.0.27-1.el9_3	ALSA-2024:0807
AlmaLinux 9	dotnet-hostfxr-7.0 +5	7.0.16-1.el9_3	ALSA-2024:2843, ALSA-2024:0805
AlmaLinux 9	dotnet-sdk-6.0 +2	6.0.127-1.el9_3	ALSA-2024:0807
AlmaLinux 9	dotnet-sdk-7.0 +2	7.0.116-1.el9_3	ALSA-2024:2843, ALSA-2024:0805
AlmaLinux 9	dotnet-sdk-8.0 +4	8.0.102-2.el9_3	ALSA-2024:0848
AlmaLinux 8	dotnet +5	8.0.102-2.el8_9	ALSA-2024:0827
AlmaLinux 8	dotnet-host +8	8.0.2-2.el8_9	ALSA-2024:0827
AlmaLinux 8	dotnet-hostfxr-6.0 +5	6.0.27-1.el8_9	ALSA-2024:0808
AlmaLinux 8	dotnet-hostfxr-7.0 +5	7.0.16-1.el8_9	ALSA-2024:3340, ALSA-2024:0806
AlmaLinux 8	dotnet-sdk-6.0 +2	6.0.127-1.el8_9	ALSA-2024:0808
AlmaLinux 8	dotnet-sdk-7.0 +2	7.0.116-1.el8_9	ALSA-2024:3340, ALSA-2024:0806

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	dotnet7.0	7.0.119-1.el9_4	RLSA-2024:2843
Rocky Linux 8	dotnet7.0	7.0.116-1.el8_9	RLSA-2024:0806
Rocky Linux 8	dotnet8.0	8.0.102-2.el8_9	RLSA-2024:0827

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	dotnet8-runtime	8.0.2-r0	—
Alpine v3.23	dotnet8-runtime	8.0.2-r0	—
Alpine v3.22	dotnet8-runtime	8.0.2-r0	—
Alpine v3.21	dotnet8-runtime	8.0.2-r0	—
Alpine v3.20	dotnet6-build	6.0.127-r0	—
Alpine v3.20	dotnet6-runtime	6.0.27-r0	—
Alpine v3.20	dotnet8-runtime	8.0.2-r0	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	dotnet6-build	6.0.127-r0	—
Alpine v3.19	dotnet6-runtime	6.0.27-r0	—
Alpine v3.19	dotnet7-build	7.0.116-r0	—
Alpine v3.19	dotnet7-runtime	7.0.16-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	dotnet +4	6.0.127-1.amzn2023.0.1	ALAS2023-2024-545
Amazon Linux 2023	dotnet-host +6	6.0.27-1.amzn2023.0.1	ALAS2023-2024-545

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	dotnet-host +8	8.0.2-2.0.1.el9_3	ELSA-2024-0848
Oracle Linux 9	dotnet-hostfxr-6.0 +5	6.0.27-1.0.1.el9_3	ELSA-2024-0807
Oracle Linux 9	dotnet-hostfxr-7.0 +5	7.0.16-1.0.1.el9_3	ELSA-2024-0805
Oracle Linux 9	dotnet-sdk-6.0 +2	6.0.127-1.0.1.el9_3	ELSA-2024-0807
Oracle Linux 9	dotnet-sdk-7.0 +2	7.0.116-1.0.1.el9_3	ELSA-2024-0805
Oracle Linux 9	dotnet-sdk-8.0 +4	8.0.102-2.0.1.el9_3	ELSA-2024-0848
Oracle Linux 8	dotnet +4	7.0.116-1.0.1.el8_9	ELSA-2024-0827, ELSA-2024-0806
Oracle Linux 8	dotnet-host +6	7.0.16-1.0.1.el8_9	ELSA-2024-0827, ELSA-2024-0806
Oracle Linux 8	dotnet-hostfxr-6.0 +5	6.0.27-1.0.1.el8_9	ELSA-2024-0808
Oracle Linux 8	dotnet-hostfxr-8.0 +7	8.0.2-2.0.1.el8_9	ELSA-2024-0827
Oracle Linux 8	dotnet-sdk-6.0 +2	6.0.127-1.0.1.el8_9	ELSA-2024-0808
Oracle Linux 8	dotnet-sdk-8.0 +3	8.0.102-2.0.1.el8_9	ELSA-2024-0827

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	< 6.0.27	6.0.27	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 7.0.0, < 7.0.16	7.0.16	GHSA-g74q-5xw3-j7q9
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 8.0.0, < 8.0.2	8.0.2	GHSA-g74q-5xw3-j7q9

Advisories 30

ALSA-2024:3340 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 6, 2026
ALSA-2024:2843 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 5, 2026
ALSA-2024:0807 Important: dotnet6.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:0848 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:0805 Important: dotnet7.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:0806 Important: dotnet7.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:0808 Important: dotnet6.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:0827 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:3340 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:2843 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0848 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0827 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0808 Red Hat Security Advisory: dotnet6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0814 Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0807 Red Hat Security Advisory: dotnet6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0806 Red Hat Security Advisory: dotnet7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:0805 Red Hat Security Advisory: dotnet7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
USN-6634-1 dotnet6, dotnet7, dotnet8 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
RLSA-2024:0806 Important: dotnet7.0 security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2024:0827 Important: .NET 8.0 security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2024:2843 Important: .NET 7.0 security update Rocky Linux Security Advisories · Oct 9, 2025
WID-SEC-2024-0365 Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Apr 2, 2024
ALAS2023-2024-545 Important: dotnet6.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2024
ELSA-2024-0827 Important: .NET 8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 21, 2024
ELSA-2024-0848 Important: .NET 8.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 16, 2024
ELSA-2024-0805 Important: dotnet7.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
ELSA-2024-0807 Important: dotnet6.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
ELSA-2024-0806 Important: dotnet7.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
ELSA-2024-0808 Important: dotnet6.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
MSRC-CVE-2024-21386 .NET Denial of Service Vulnerability Microsoft Security Response Center · Feb 13, 2024

References

.NET Denial of Service Vulnerability vendor-advisory patch

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5