CVE-2019-0564

Denial of service in ASP.NET Core

7.5 HighFix available

CVE-2019-0564 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published January 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.39%, the 94th percentile. Fixed in Microsoft.AspNetCore.WebSockets 2.2.1.

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

8.39%Down 2.9 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2019-0564
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-19
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-0564
Updated: 2026-11-02

EUVDEUVD-2022-2841 No score

Record: EUVD-2022-2841
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6px8-22w5-w334 7.5

Denial of service in ASP.NET Core

Record: GHSA-6px8-22w5-w334
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2019-0564
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-6px8-22w5-w334 7.5

Denial of service in ASP.NET Core

Record: GHSA-6px8-22w5-w334
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2019:0040 5.9

Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update

Record: RHSA-2019:0040
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

microsoft asp.net core

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.AspNetCore.WebSockets` NuGet	2.2.0 to 2.2.0	2.2.1
`Microsoft.AspNetCore.WebSockets` NuGet	2.1.0 up to 2.1.7	2.1.7
`Microsoft.AspNetCore.Server.Kestrel.Core` NuGet	2.1.0 up to 2.1.7	2.1.7
`System.Net.WebSockets.WebSocketProtocol` NuGet	4.5.0 up to 4.5.3	4.5.3
`Microsoft.NETCore.App` NuGet	2.2.0 to 2.2.0	2.2.1
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.7	2.1.7
`Microsoft.AspNetCore.App` NuGet	2.2.0 to 2.2.0	2.2.1
`Microsoft.AspNetCore.App` NuGet	2.1.0 up to 2.1.7	2.1.7
`Microsoft.AspNetCore.All` NuGet	2.2.0 to 2.2.0	2.2.1
`Microsoft.AspNetCore.All` NuGet	2.1.0 up to 2.1.7	2.1.7

Show 27 moreShow less

Affected packages
Package	Affected	Fixed
`Microsoft.AspNetCore.WebSockets` NuGet	2.2.0 up to 2.2.1	2.2.1
`Microsoft.AspNetCore.WebSockets` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.1	2.1.7
`Microsoft.AspNetCore.Server.Kestrel.Core` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.3	2.1.7
`System.Net.WebSockets.WebSocketProtocol` NuGet	4.5.0 up to 4.5.3, plus listed versions 4.5.14.5.2	4.5.3
`Microsoft.NETCore.App` NuGet	2.2.0 up to 2.2.1	2.2.1
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.6	2.1.7
`Microsoft.AspNetCore.App` NuGet	2.2.0 up to 2.2.1	2.2.1
`Microsoft.AspNetCore.App` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.6	2.1.7
`Microsoft.AspNetCore.All` NuGet	2.2.0 up to 2.2.1	2.2.1
`Microsoft.AspNetCore.All` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.6	2.1.7
`rh-dotnet21` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-6.el7	0:2.1-6.el7
`rh-dotnet21-dotnet` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.503-1.el7	0:2.1.503-1.el7
`rh-dotnet21-dotnet-debuginfo` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.503-1.el7	0:2.1.503-1.el7
`rh-dotnet21-dotnet-host` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.7-1.el7	0:2.1.7-1.el7
`rh-dotnet21-dotnet-runtime-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.7-1.el7	0:2.1.7-1.el7
`rh-dotnet21-dotnet-sdk-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.503-1.el7	0:2.1.503-1.el7
`rh-dotnet21-dotnet-sdk-2.1.5xx` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.503-1.el7	0:2.1.503-1.el7
`rh-dotnet21-runtime` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-6.el7	0:2.1-6.el7
`rh-dotnet22` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2-2.el7	0:2.2-2.el7
`rh-dotnet22-dotnet` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.102-1.el7	0:2.2.102-1.el7
`rh-dotnet22-dotnet-debuginfo` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.102-1.el7	0:2.2.102-1.el7
`rh-dotnet22-dotnet-host` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.1-1.el7	0:2.2.1-1.el7
`rh-dotnet22-dotnet-host-fxr-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.1-1.el7	0:2.2.1-1.el7
`rh-dotnet22-dotnet-runtime-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.1-1.el7	0:2.2.1-1.el7
`rh-dotnet22-dotnet-sdk-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.102-1.el7	0:2.2.102-1.el7
`rh-dotnet22-dotnet-sdk-2.2.1xx` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.102-1.el7	0:2.2.102-1.el7
`rh-dotnet22-runtime` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2-2.el7	0:2.2-2.el7

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 16 moreShow less