GitHub Advisoryadvisory · NuGet

GHSA-8xc6-g8xw-h2c4 YARP Denial of Service Vulnerability

HIGH Published 2022-04-22 Modified 2022-04-22 Official page ↗
Aliases
CVE-2022-26924
Ecosystem
NuGet
Packages
Yarp.ReverseProxy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed
2022-04-22

Affected packages

• NuGet Yarp.ReverseProxy: < 1.0.1 → fixed in 1.0.1 • NuGet Yarp.ReverseProxy: >= 1.1.0-rc.1.22152.1, < 1.1.0-rc.1.22211.2 → fixed in 1.1.0-rc.1.22211.2

Description

Impact A denial of service vulnerability exists in how YARP processes input. Patches If you're using YARP `1.0.0`, you should update to NuGet package version `1.0.1`. If you're using YARP `1.1.0-RC.1`, you should update to NuGet package version `1.1.0-rc.1.22211.2`. You can do so by updating the `PackageReference` in your `.csproj` file ```diff • • + + ``` or by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`) References CVE-2022-26924

Related

Alias · CVE (1)

References