Start for Free
HIGH 7.5 NuGet

.NET Denial of Service Vulnerability

GHSA-485p-mrj5-8w2v · BIT-dotnet-2022-23267 · BIT-dotnet-sdk-2022-23267 · BIT-powershell-2022-23267 · CVE-2022-23267

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 5.0 and .NET Core 3.1 where a malicious client can cause a Denial of Service via excess memory allocations through HttpClient.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.4 or earlier.
  • Any .NET 5.0 application running .NET 5.0.16 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.24 or earlier.

Patches

.NET 6.0, .NET 5.0 and .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Other Details

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/221
An Issue for this can be found at https://github.com/dotnet/runtime/issues/69149
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23267

References

More NuGet vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes