GitHub Advisoryadvisory · NuGet
GHSA-jrjw-qgr2-wfcg YARP Denial of Service Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2023-33141
- Ecosystem
- NuGet
- Packages
- Yarp.ReverseProxy
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2023-06-23
Affected packages
• NuGet Yarp.ReverseProxy: < 1.1.2 → fixed in 1.1.2
• NuGet Yarp.ReverseProxy: >= 2.0.0, < 2.0.1 → fixed in 2.0.1
Description
Impact
A denial of service vulnerability exists in YARP.
Patches
If you're using YARP 1.x, you should update to NuGet package version 1.1.2.
If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.
You can do so by updating the `PackageReference` in your `.csproj` file
```diff
•
•
+
+
```
or by selecting `2.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)
References
CVE-2023-33141
Related
Alias · CVE (1)
- CVE-2023-33141 Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-jrjw-qgr2-wfcg web
- https://nvd.nist.gov/vuln/detail/CVE-2023-33141 advisory
- https://github.com/microsoft/reverse-proxy package
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141 web
- https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2 web
- https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1 web