Description
.NET Denial of Service Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET 6.0 | 6.0.0 – < 6.0.27 | 6.0.27 |
| Microsoft | .NET 7.0 | 7.0.0 – < 7.0.16 | 7.0.16 |
| Microsoft | .NET 8.0 | 8.0 – < 8.0.2 | 8.0.2 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – < 17.4.16 | 17.4.16 |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 – < 17.6.12 | 17.6.12 |
| Microsoft | Microsoft Visual Studio 2022 version 17.8 | 17.8.0 – < 17.8.7 | 17.8.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dotnet6 | 6.0.127-0ubuntu1~22.04.1 | USN-6634-1 |
| Ubuntu 22.04 LTS | dotnet7 | 7.0.116-0ubuntu1~22.04.1 | USN-6634-1 |
| Ubuntu 22.04 LTS | dotnet8 | 8.0.102-8.0.2-0ubuntu1~22.04.1 | USN-6634-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | dotnet-host +8 | 8.0.2-2.el9_3 | RHSA-2024:0848 |
| RHEL 9 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el9_3 | RHSA-2024:0807 |
| RHEL 9 | dotnet-hostfxr-7.0 +5 | 7.0.16-1.el9_3 | RHSA-2024:2843, RHSA-2024:0805 |
| RHEL 9 | dotnet6.0 +3 | 6.0.127-1.el9_3 | RHSA-2024:0807 |
| RHEL 9 | dotnet7.0 +3 | 7.0.116-1.el9_3 | RHSA-2024:2843, RHSA-2024:0805 |
| RHEL 9 | dotnet8.0 +5 | 8.0.102-2.el9_3 | RHSA-2024:0848 |
| RHEL 8 | dotnet +6 | 8.0.102-2.el8_9 | RHSA-2024:0827 |
| RHEL 8 | dotnet-host +8 | 8.0.2-2.el8_9 | RHSA-2024:0827 |
| RHEL 8 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el8_9 | RHSA-2024:0808 |
| RHEL 8 | dotnet-hostfxr-7.0 +5 | 7.0.16-1.el8_9 | RHSA-2024:3340, RHSA-2024:0806 |
| RHEL 8 | dotnet6.0 +3 | 6.0.127-1.el8_9 | RHSA-2024:0808 |
| RHEL 8 | dotnet7.0 +3 | 7.0.116-1.el8_9 | RHSA-2024:3340, RHSA-2024:0806 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 6 | rh-dotnet60-dotnet +4 | 6.0.127-1.el7_9 | RHSA-2024:0814 |
| Red Hat Rhel Dotnet 6 | rh-dotnet60-dotnet-host +6 | 6.0.27-1.el7_9 | RHSA-2024:0814 |
| RHEL 9.2 EUS | dotnet-host +6 | 7.0.16-1.el9_2 | RHSA-2024:1643 |
| RHEL 9.2 EUS | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el9_2.1 | RHSA-2024:1555 |
| RHEL 9.2 EUS | dotnet6.0 +3 | 6.0.127-1.el9_2.1 | RHSA-2024:1555 |
| RHEL 9.2 EUS | dotnet7.0 +4 | 7.0.116-1.el9_2 | RHSA-2024:1643 |
| RHEL 9.0 EUS | dotnet-host +6 | 6.0.27-1.el9_0 | RHSA-2024:1552 |
| RHEL 9.0 EUS | dotnet6.0 +4 | 6.0.127-1.el9_0 | RHSA-2024:1552 |
| RHEL 8.8 EUS | dotnet +5 | 7.0.116-1.el8_8 | RHSA-2024:1641 |
| RHEL 8.8 EUS | dotnet-host +6 | 7.0.16-1.el8_8 | RHSA-2024:1641 |
| RHEL 8.8 EUS | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el8_8 | RHSA-2024:1553 |
| RHEL 8.8 EUS | dotnet6.0 +3 | 6.0.127-1.el8_8 | RHSA-2024:1553 |
| RHEL 8.6 EUS | dotnet +5 | 6.0.127-1.el8_6 | RHSA-2024:1554 |
| RHEL 8.6 EUS | dotnet-host +6 | 6.0.27-1.el8_6 | RHSA-2024:1554 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | dotnet-host +8 | 8.0.2-2.el9_3 | ALSA-2024:0848 |
| AlmaLinux 9 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el9_3 | ALSA-2024:0807 |
| AlmaLinux 9 | dotnet-hostfxr-7.0 +5 | 7.0.16-1.el9_3 | ALSA-2024:2843, ALSA-2024:0805 |
| AlmaLinux 9 | dotnet-sdk-6.0 +2 | 6.0.127-1.el9_3 | ALSA-2024:0807 |
| AlmaLinux 9 | dotnet-sdk-7.0 +2 | 7.0.116-1.el9_3 | ALSA-2024:2843, ALSA-2024:0805 |
| AlmaLinux 9 | dotnet-sdk-8.0 +4 | 8.0.102-2.el9_3 | ALSA-2024:0848 |
| AlmaLinux 8 | dotnet +5 | 8.0.102-2.el8_9 | ALSA-2024:0827 |
| AlmaLinux 8 | dotnet-host +8 | 8.0.2-2.el8_9 | ALSA-2024:0827 |
| AlmaLinux 8 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.el8_9 | ALSA-2024:0808 |
| AlmaLinux 8 | dotnet-hostfxr-7.0 +5 | 7.0.16-1.el8_9 | ALSA-2024:3340, ALSA-2024:0806 |
| AlmaLinux 8 | dotnet-sdk-6.0 +2 | 6.0.127-1.el8_9 | ALSA-2024:0808 |
| AlmaLinux 8 | dotnet-sdk-7.0 +2 | 7.0.116-1.el8_9 | ALSA-2024:3340, ALSA-2024:0806 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | dotnet7.0 | 7.0.119-1.el9_4 | RLSA-2024:2843 |
| Rocky Linux 8 | dotnet7.0 | 7.0.116-1.el8_9 | RLSA-2024:0806 |
| Rocky Linux 8 | dotnet8.0 | 8.0.102-2.el8_9 | RLSA-2024:0827 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dotnet8-runtime | 8.0.2-r0 | — |
| Alpine v3.23 | dotnet8-runtime | 8.0.2-r0 | — |
| Alpine v3.22 | dotnet8-runtime | 8.0.2-r0 | — |
| Alpine v3.21 | dotnet8-runtime | 8.0.2-r0 | — |
| Alpine v3.20 | dotnet6-build | 6.0.127-r0 | — |
| Alpine v3.20 | dotnet6-runtime | 6.0.27-r0 | — |
| Alpine v3.20 | dotnet8-runtime | 8.0.2-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | dotnet6-build | 6.0.127-r0 | — |
| Alpine v3.19 | dotnet6-runtime | 6.0.27-r0 | — |
| Alpine v3.19 | dotnet7-build | 7.0.116-r0 | — |
| Alpine v3.19 | dotnet7-runtime | 7.0.16-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | dotnet +4 | 6.0.127-1.amzn2023.0.1 | ALAS2023-2024-545 |
| Amazon Linux 2023 | dotnet-host +6 | 6.0.27-1.amzn2023.0.1 | ALAS2023-2024-545 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | dotnet-host +8 | 8.0.2-2.0.1.el9_3 | ELSA-2024-0848 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.0.1.el9_3 | ELSA-2024-0807 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 +5 | 7.0.16-1.0.1.el9_3 | ELSA-2024-0805 |
| Oracle Linux 9 | dotnet-sdk-6.0 +2 | 6.0.127-1.0.1.el9_3 | ELSA-2024-0807 |
| Oracle Linux 9 | dotnet-sdk-7.0 +2 | 7.0.116-1.0.1.el9_3 | ELSA-2024-0805 |
| Oracle Linux 9 | dotnet-sdk-8.0 +4 | 8.0.102-2.0.1.el9_3 | ELSA-2024-0848 |
| Oracle Linux 8 | dotnet +4 | 7.0.116-1.0.1.el8_9 | ELSA-2024-0827, ELSA-2024-0806 |
| Oracle Linux 8 | dotnet-host +6 | 7.0.16-1.0.1.el8_9 | ELSA-2024-0827, ELSA-2024-0806 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 +5 | 6.0.27-1.0.1.el8_9 | ELSA-2024-0808 |
| Oracle Linux 8 | dotnet-hostfxr-8.0 +7 | 8.0.2-2.0.1.el8_9 | ELSA-2024-0827 |
| Oracle Linux 8 | dotnet-sdk-6.0 +2 | 6.0.127-1.0.1.el8_9 | ELSA-2024-0808 |
| Oracle Linux 8 | dotnet-sdk-8.0 +3 | 8.0.102-2.0.1.el8_9 | ELSA-2024-0827 |
Advisories 36
- ALSA-2024:3340 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2024:2843 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 5, 2026
- ALSA-2024:0848 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0805 Important: dotnet7.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0807 Important: dotnet6.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0808 Important: dotnet6.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0827 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0806 Important: dotnet7.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:3340 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:2843 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1641 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1643 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1555 Red Hat Security Advisory: .NET 6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1553 Red Hat Security Advisory: .NET 6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1554 Red Hat Security Advisory: .NET 6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:1552 Red Hat Security Advisory: .NET 6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0848 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0827 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0808 Red Hat Security Advisory: dotnet6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0814 Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0807 Red Hat Security Advisory: dotnet6.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0806 Red Hat Security Advisory: dotnet7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2024:0805 Red Hat Security Advisory: dotnet7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- USN-6634-1 dotnet6, dotnet7, dotnet8 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2024:0806 Important: dotnet7.0 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:0827 Important: .NET 8.0 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:2843 Important: .NET 7.0 security update Rocky Linux Security Advisories · Oct 9, 2025
- WID-SEC-2024-0365 Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Apr 2, 2024
- ALAS2023-2024-545 Important: dotnet6.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2024
- ELSA-2024-0827 Important: .NET 8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 21, 2024
- ELSA-2024-0848 Important: .NET 8.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 16, 2024
- ELSA-2024-0807 Important: dotnet6.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
- ELSA-2024-0806 Important: dotnet7.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
- ELSA-2024-0808 Important: dotnet6.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
- ELSA-2024-0805 Important: dotnet7.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 15, 2024
- MSRC-CVE-2024-21404 .NET Denial of Service Vulnerability Microsoft Security Response Center · Feb 13, 2024
References
- .NET Denial of Service Vulnerability vendor-advisory patch