CVE-2020-1161
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1161- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1161- Updated
- 2026-11-02
EUVDEUVD-2022-2160 No score
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
EUVD-2022-2160- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3cf7-7wq6-8842
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
- Record
GHSA-3cf7-7wq6-8842- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1161- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-3cf7-7wq6-8842
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
- Record
GHSA-3cf7-7wq6-8842- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2020:2249
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update
- Record
RHSA-2020:2249- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2250
Red Hat Security Advisory: dotnet3.1 security update
- Record
RHSA-2020:2250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-aspnet-core-2020-1161 No score
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
BIT-aspnet-core-2020-1161- Updated
- 2026-11-02
Affected products
- microsoft asp.net core
- microsoft asp.net core 3.1
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)
- microsoft visual studio 2019 version 16.0
- microsoft visual studio 2019 version 16.4 (includes 16.0 - 16.3)
- microsoft visual studio 2019 version 16.5
- microsoft visual studio 2017
- microsoft visual studio 2019
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
aspnet-coreBitnami |
3.1.0 up to 3.1.1 | 3.1.1 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
aspnetcore-runtime-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
aspnetcore-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-apphost-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-apphost-pack-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostfxr-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostfxr-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-runtime-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-runtime-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-sdk-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-sdk-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-templates-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1161 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published May 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.31%, the 92nd percentile. Fixed in Microsoft.AspNetCore.App.Runtime.linux-arm 3.1.4.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1161
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1161
nvd.nist.gov/vuln/detail/CVE-2020-1161
github.com/aspnet/Announcements/issues/416
access.redhat.com/errata/RHSA-2020:2249
Show 12 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1827643
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2249.json
cve.org/CVERecord?id=CVE-2020-1108