GitHub Advisoryadvisory · NuGet

GHSA-3m2r-q8x3-xmf7 Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

MEDIUM Published 2018-10-16 Modified 2021-12-03 Official page ↗
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv, Microsoft.AspNetCore.All
Severity
Moderate
Reviewed
2020-06-16

Affected packages

• NuGet Microsoft.AspNetCore.Server.Kestrel.Core: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • NuGet Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • NuGet Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • NuGet Microsoft.AspNetCore.All: >= 2.0.0, < 2.0.8 → fixed in 2.0.8

Description

Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

References