CVE-2021-41355

.NET Core and Visual Studio Information Disclosure Vulnerability

5.7 MediumFix available

.NET Core and Visual Studio Information Disclosure Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

20.3%Up 19.9 points since Oct 13, 2021

What each source reports

CVE List Score used 5.7

.NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: CVE-2021-41355
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Updated: 2026-11-02

EUVDEUVD-2021-2183 5.7

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: EUVD-2021-2183
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9cxh-gqpx-qc5m 5.7

Credential Disclosure in System.DirectoryServices.Protocols

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.

Patches

Any .NET application that uses System.DirectoryServices.Protocols with a vulnerable version listed below on system based on Linux.

Package name | Vulnerable versions | Secure versions ------------ | ---------------- | ------------------------- System.DirectoryServices.Protocols | 5.0.0 | 5.0.1

Other Details

Announcement for this issue can be found at dotnet/announcements#202
An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355

Record: GHSA-9cxh-gqpx-qc5m
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 5.7

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: CVE-2021-41355
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0: 2.9 LowAV:A/AC:M/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

OSV 5.7

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: CVE-2021-41355
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-9cxh-gqpx-qc5m 5.7

Credential Disclosure in System.DirectoryServices.Protocols

A Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.

Patches

Any .NET application that uses System.DirectoryServices.Protocols with a vulnerable version listed below on system based on Linux.

Package name | Vulnerable versions | Secure versions ------------ | ---------------- | ------------------------- System.DirectoryServices.Protocols | 5.0.0 | 5.0.1

Other Details

Announcement for this issue can be found at dotnet/announcements#202
An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355

Record: GHSA-9cxh-gqpx-qc5m
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Show 6 moreShow less

OSVRHSA-2021:3818 5.7

Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update

Record: RHSA-2021:3818
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2021:3819 5.7

Red Hat Security Advisory: .NET 5.0 security and bugfix update

Record: RHSA-2021:3819
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVALSA-2021:3819 No score

Important: .NET 5.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.208 and .NET Runtime 5.0.11.

Security Fix(es):

dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails (CVE-2021-41355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2021:3819
Updated: 2026-11-02

OSVBIT-dotnet-2021-41355 No score

.NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: BIT-dotnet-2021-41355
Updated: 2026-11-02

OSVBIT-dotnet-sdk-2021-41355 No score

.NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: BIT-dotnet-sdk-2021-41355
Updated: 2026-11-02

OSVBIT-powershell-2021-41355 No score

.NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Record: BIT-powershell-2021-41355
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`System.DirectoryServices.Protocols` NuGet	before 5.0.1	5.0.1
`aspnetcore-runtime-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`aspnetcore-targeting-pack-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`dotnet-apphost-pack-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`dotnet-hostfxr-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`dotnet-runtime-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`dotnet-sdk-5.0` AlmaLinux:8	before 5.0.208-1.el8_4	5.0.208-1.el8_4
`dotnet-targeting-pack-5.0` AlmaLinux:8	before 5.0.11-1.el8_4	5.0.11-1.el8_4
`dotnet-templates-5.0` AlmaLinux:8	before 5.0.208-1.el8_4	5.0.208-1.el8_4
`dotnet` Bitnami	5.0.0 up to 5.0.1	5.0.1

Show 35 moreShow less

Affected packages
Package	Affected	Fixed
`dotnet-sdk` Bitnami	5.0.0 up to 5.0.1	5.0.1
`powershell` Bitnami	7.1.0 up to 7.1.5	7.1.5
`System.DirectoryServices.Protocols` NuGet	before 5.0.1, plus listed versions 4.5.04.5.0-preview1-25914-044.5.0-preview1-26216-024.5.0-preview2-26406-044.5.0-rc14.6.04.7.05.0.0	5.0.1
`rh-dotnet50-aspnetcore-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-aspnetcore-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`rh-dotnet50-dotnet-apphost-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet-debuginfo` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`rh-dotnet50-dotnet-host` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet-hostfxr-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet-sdk-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`rh-dotnet50-dotnet-sdk-5.0-source-built-artifacts` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`rh-dotnet50-dotnet-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.11-1.el7_9	0:5.0.11-1.el7_9
`rh-dotnet50-dotnet-templates-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`rh-dotnet50-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.208-1.el7_9	0:5.0.208-1.el7_9
`aspnetcore-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`aspnetcore-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet-apphost-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-apphost-pack-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-host` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-hostfxr-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-hostfxr-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-runtime-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-sdk-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet-sdk-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.11-1.el8_4	0:5.0.11-1.el8_4
`dotnet-templates-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`dotnet5.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream	before 0:5.0.208-1.el8_4	0:5.0.208-1.el8_4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41355 is a medium vulnerability (CVSS 5.7) in Microsoft .net, published October 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 20.3%, the 97th percentile. Fixed in System.DirectoryServices.Protocols 5.0.1.

References

Show 15 moreShow less