~ / search / GHSA-242j-2gm6-5rwx

GHSA-242j-2gm6-5rwx

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2021-1723

Packages

EcosystemPackageAffectedFixed in
NuGet Microsoft.AspNetCore.Server.Kestrel.Core < 2.1.25 2.1.25
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 3.1.0, < 3.1.11 3.1.11
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 5.0.0, < 5.0.2 5.0.2
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 5.0.1, < 5.0.2 5.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.

References

External links from the advisory. They lead to third-party sites.