CVE-2021-1723

ASP.NET Core and Visual Studio Denial of Service Vulnerability

7.5 HighFix available

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

5.30%Down 0.3 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-1723
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

EUVDEUVD-2022-1900 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: EUVD-2022-1900
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-242j-2gm6-5rwx 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.

Record: GHSA-242j-2gm6-5rwx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-1723
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSV 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-1723
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-242j-2gm6-5rwx 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: GHSA-242j-2gm6-5rwx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVRHSA-2021:0094 7.5

Red Hat Security Advisory: dotnet5.0 security and bugfix update

Record: RHSA-2021:0094
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:0095 7.5

Red Hat Security Advisory: dotnet3.1 security and bugfix update

Record: RHSA-2021:0095
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:0096 7.5

Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update

Record: RHSA-2021:0096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:0114 7.5

Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update

Record: RHSA-2021:0114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-aspnet-core-2021-1723 No score

ASP.NET Core and Visual Studio Denial of Service Vulnerability

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Record: BIT-aspnet-core-2021-1723
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.AspNetCore.Server.Kestrel.Core` NuGet	before 2.1.25	2.1.25
`Microsoft.AspNetCore.App.Runtime.linux-arm` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-arm` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-arm64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-arm64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-x64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-musl-x64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-x64` NuGet	3.1.0 up to 3.1.11	3.1.11

Show 93 moreShow less

Affected packages
Package	Affected	Fixed
`Microsoft.AspNetCore.App.Runtime.linux-x64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.osx-x64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.osx-x64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-arm` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-arm` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-arm64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-arm64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-x64` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-x64` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-x86` NuGet	3.1.0 up to 3.1.11	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-x86` NuGet	5.0.0 up to 5.0.2	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm` NuGet	5.0.1 to 5.0.1	5.0.2
`aspnet-core` Bitnami	3.1.0 up to 3.1.11, 5.0.0 up to 5.0.2	3.1.115.0.2
`Microsoft.AspNetCore.Server.Kestrel.Core` NuGet	before 2.1.25, plus listed versions 0.0.1-alpha2.0.02.0.0-preview1-final2.0.0-preview2-final2.0.1 Show 11 moreShow less 2.0.22.0.32.0.42.1.02.1.0-preview1-final2.1.0-preview2-final2.1.0-rc1-final2.1.12.1.22.1.32.1.7	2.1.25
`Microsoft.AspNetCore.App.Runtime.linux-arm` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-arm` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-arm64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-arm64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-x64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-musl-x64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-x64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.linux-x64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.osx-x64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.osx-x64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-arm` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-arm` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-arm64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.103.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-arm64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-x64` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-x64` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.win-x86` NuGet	3.1.0 up to 3.1.11, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less 3.1.53.1.63.1.73.1.83.1.9	3.1.11
`Microsoft.AspNetCore.App.Runtime.win-x86` NuGet	5.0.0 up to 5.0.2, plus listed versions 5.0.1	5.0.2
`Microsoft.AspNetCore.App.Runtime.linux-musl-arm` NuGet	5.0.1 up to 5.0.2	5.0.2
`aspnetcore-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`aspnetcore-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet-apphost-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-apphost-pack-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-host` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-hostfxr-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-hostfxr-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-runtime-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-sdk-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet-sdk-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.2-2.el8_3	0:5.0.2-2.el8_3
`dotnet-templates-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`dotnet5.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream	before 0:5.0.102-2.el8_3	0:5.0.102-2.el8_3
`aspnetcore-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`aspnetcore-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-apphost-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-apphost-pack-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-hostfxr-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-hostfxr-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-runtime-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-sdk-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`dotnet-sdk-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`dotnet-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.11-1.el8_3	0:3.1.11-1.el8_3
`dotnet-templates-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`dotnet3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`dotnet3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`dotnet3.1-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:3.1.111-1.el8_3	0:3.1.111-1.el8_3
`rh-dotnet50-aspnetcore-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-aspnetcore-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.102-1.el7_9	0:5.0.102-1.el7_9
`rh-dotnet50-dotnet-apphost-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet-debuginfo` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.102-1.el7_9	0:5.0.102-1.el7_9
`rh-dotnet50-dotnet-host` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet-hostfxr-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet-sdk-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.102-1.el7_9	0:5.0.102-1.el7_9
`rh-dotnet50-dotnet-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.2-1.el7_9	0:5.0.2-1.el7_9
`rh-dotnet50-dotnet-templates-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.102-1.el7_9	0:5.0.102-1.el7_9
`rh-dotnet50-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.102-1.el7_9	0:5.0.102-1.el7_9
`rh-dotnet31-aspnetcore-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-aspnetcore-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.111-1.el7_9	0:3.1.111-1.el7_9
`rh-dotnet31-dotnet-apphost-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet-debuginfo` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.111-1.el7_9	0:3.1.111-1.el7_9
`rh-dotnet31-dotnet-host` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet-hostfxr-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet-sdk-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.111-1.el7_9	0:3.1.111-1.el7_9
`rh-dotnet31-dotnet-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.11-1.el7_9	0:3.1.11-1.el7_9
`rh-dotnet31-dotnet-templates-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.111-1.el7_9	0:3.1.111-1.el7_9
`rh-dotnet31-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.111-1.el7_9	0:3.1.111-1.el7_9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-1723 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published January 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.30%, the 92nd percentile. Fixed in Microsoft.AspNetCore.Server.Kestrel.Core 2.1.25.

References

Show 14 moreShow less