CVE-2020-1469
Infinite loop in .Net Bond
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
- Record
CVE-2020-1469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
- Record
CVE-2020-1469- Updated
- 2026-11-02
EUVDEUVD-2022-1826 No score
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
- Record
EUVD-2022-1826- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqrc-8q8f-cp9c
Infinite loop in .Net Bond
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads.
- Record
GHSA-rqrc-8q8f-cp9c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-434, CWE-835
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
- Record
CVE-2020-1469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-rqrc-8q8f-cp9c
Infinite loop in .Net Bond
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads.
- Record
GHSA-rqrc-8q8f-cp9c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-434, CWE-835
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Bond.Core.CSharpNuGet |
3.0.0 up to 9.0.1 | 9.0.1 |
Bond.Core.CSharpNuGet |
3.0.0 up to 9.0.1, plus listed versions 4.0.14.0.24.1.04.2.04.2.1 Show 13 moreShow less4.3.05.0.05.1.05.2.05.3.05.3.16.0.07.0.07.0.18.0.08.1.08.2.09.0.0 |
9.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1469 is a high vulnerability (CVSS 7.5) in Microsoft Bond, published July 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.84%, the 92nd percentile. Fixed in Bond.Core.CSharp 9.0.1.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1469
nvd.nist.gov/vuln/detail/CVE-2020-1469
github.com/microsoft/bond/commit/3afea822c42dd0095fedb9e7db9ebb99165e7343
msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1469
nuget.org/packages/Bond.Core.CSharp/9.0.1