CVE-2017-0247
ASP.NET Core fails to properly validate web requests
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
- Record
CVE-2017-0247- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
- Record
CVE-2017-0247- Updated
- 2026-11-02
EUVDEUVD-2018-0527 No score
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
- Record
EUVD-2018-0527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6xh7-4v2w-36q6
ASP.NET Core fails to properly validate web requests
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
- Record
GHSA-6xh7-4v2w-36q6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-6xh7-4v2w-36q6
ASP.NET Core fails to properly validate web requests
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
- Record
GHSA-6xh7-4v2w-36q6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- microsoft asp.net core
- microsoft system.text.encodings.web
- microsoft asp.net model view controller
- microsoft microsoft.aspnetcore.mvc.abstractions
- microsoft microsoft.aspnetcore.mvc.apiexplorer
- microsoft microsoft.aspnetcore.mvc.cors
- microsoft microsoft.aspnetcore.mvc.dataannotations
- microsoft microsoft.aspnetcore.mvc.formatters.json
- microsoft microsoft.aspnetcore.mvc.formatters.xml
- microsoft microsoft.aspnetcore.mvc.localization
- microsoft microsoft.aspnetcore.mvc.razor
- microsoft microsoft.aspnetcore.mvc.razor.host
Show 8 moreShow less
- microsoft microsoft.aspnetcore.mvc.taghelpers
- microsoft microsoft.aspnetcore.mvc.viewfeatures
- microsoft microsoft.aspnetcore.mvc.webapicompatshim
- microsoft system.net.http
- microsoft system.net.http.winhttphandler
- microsoft system.net.security
- microsoft system.net.websockets.client
- microsoft corporation asp.net core
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.MvcNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.MvcNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.CoreNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.CoreNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
System.Net.HttpNuGet |
4.1.1 to 4.1.1 | 4.1.2 |
System.Net.HttpNuGet |
4.3.1 to 4.3.1 | 4.3.2 |
System.Text.Encodings.WebNuGet |
4.0.0 to 4.0.0 | 4.0.1 |
System.Text.Encodings.WebNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.Net.Http.WinHttpHandlerNuGet |
4.0.0 to 4.0.0 | 4.0.1 |
System.Net.SecurityNuGet |
4.0.0 to 4.0.0 | 4.0.1 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
System.Net.SecurityNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.Net.WebSockets.ClientNuGet |
4.0.0 to 4.0.0 | 4.0.1 |
System.Net.WebSockets.ClientNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
Microsoft.AspNetCore.Mvc.AbstractionsNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.AbstractionsNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.ApiExplorerNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.ApiExplorerNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.CorsNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.CorsNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.DataAnnotationsNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.DataAnnotationsNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.Formatters.JsonNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.Formatters.JsonNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.Formatters.XmlNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.Formatters.XmlNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.LocalizationNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.LocalizationNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.Razor.HostNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.Razor.HostNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.RazorNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.RazorNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.TagHelpersNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.TagHelpersNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.ViewFeaturesNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.ViewFeaturesNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
Microsoft.AspNetCore.Mvc.WebApiCompatShimNuGet |
1.0.0 up to 1.0.4 | 1.0.4 |
Microsoft.AspNetCore.Mvc.WebApiCompatShimNuGet |
1.1.0 up to 1.1.3 | 1.1.3 |
System.Net.Http.WinHttpHandlerNuGet |
4.3.0 up to 4.5.4 | 4.5.4 |
Microsoft.AspNetCore.MvcNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.MvcNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.CoreNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.CoreNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
System.Net.HttpNuGet |
4.1.1 up to 4.1.2 | 4.1.2 |
System.Net.HttpNuGet |
4.3.1 up to 4.3.2 | 4.3.2 |
System.Text.Encodings.WebNuGet |
4.0.0 up to 4.0.1 | 4.0.1 |
System.Text.Encodings.WebNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.Net.Http.WinHttpHandlerNuGet |
4.0.0 up to 4.0.1 | 4.0.1 |
System.Net.Http.WinHttpHandlerNuGet |
4.3.0 up to 4.5.4, plus listed versions 4.3.14.3.24.3.34.4.04.4.0-preview1-25305-02 Show 9 moreShow less4.4.0-preview2-25405-014.5.04.5.0-preview1-26216-024.5.0-preview2-26406-044.5.0-rc14.5.14.5.24.5.2-servicing-27114-054.5.3 |
4.5.4 |
System.Net.SecurityNuGet |
4.0.0 up to 4.0.1 | 4.0.1 |
System.Net.SecurityNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.Net.WebSockets.ClientNuGet |
4.0.0 up to 4.0.1 | 4.0.1 |
System.Net.WebSockets.ClientNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
Microsoft.AspNetCore.Mvc.AbstractionsNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.AbstractionsNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.ApiExplorerNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.ApiExplorerNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.CorsNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.CorsNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.DataAnnotationsNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.DataAnnotationsNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.Formatters.JsonNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.Formatters.JsonNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.Formatters.XmlNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.Formatters.XmlNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.LocalizationNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.LocalizationNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.Razor.HostNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.Razor.HostNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.RazorNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.RazorNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.TagHelpersNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.TagHelpersNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.ViewFeaturesNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.ViewFeaturesNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
Microsoft.AspNetCore.Mvc.WebApiCompatShimNuGet |
1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
Microsoft.AspNetCore.Mvc.WebApiCompatShimNuGet |
1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 |
1.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-0247 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published May 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.9%, the 97th percentile. Fixed in Microsoft.AspNetCore.Mvc 1.1.3.