CVE-2023-33141

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

7.5 HighFix available

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.22%Up 2.2 points since Jun 23, 2023

What each source reports

CVE List Score used 7.5

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Record: CVE-2023-33141
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2023-1836 7.5

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Record: EUVD-2023-1836
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jrjw-qgr2-wfcg 7.5

YARP Denial of Service Vulnerability

Impact

A denial of service vulnerability exists in YARP.

Patches

If you're using YARP 1.x, you should update to NuGet package version 1.1.2. If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.

You can do so by updating the PackageReference in your .csproj file

<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>

or by selecting 2.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)

References

CVE-2023-33141

Record: GHSA-jrjw-qgr2-wfcg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 7.5

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Record: CVE-2023-33141
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Record: CVE-2023-33141
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-jrjw-qgr2-wfcg 7.5

YARP Denial of Service Vulnerability

Impact

A denial of service vulnerability exists in YARP.

Patches

If you're using YARP 1.x, you should update to NuGet package version 1.1.2. If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.

You can do so by updating the PackageReference in your .csproj file

<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>

or by selecting 2.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)

References

CVE-2023-33141

Record: GHSA-jrjw-qgr2-wfcg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Yarp.ReverseProxy` NuGet	through 1.1.1	1.1.2
`Yarp.ReverseProxy` NuGet	2.0.0 to 2.0.0	2.0.1
`Yarp.ReverseProxy` NuGet	before 1.1.2, plus listed versions 1.0.01.0.11.1.01.1.1	1.1.2
`Yarp.ReverseProxy` NuGet	2.0.0 up to 2.0.1	2.0.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-33141 is a high vulnerability (CVSS 7.5) in Microsoft Yet Another Reverse Proxy, published June 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in Yarp.ReverseProxy 1.1.2.