CVE-2020-1597
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1597- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1597- Updated
- 2026-11-02
EUVDEUVD-2022-3728 No score
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
EUVD-2022-3728- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f8qx-mjcq-wfgx
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka ASP.NET Core Denial of Service Vulnerability.
- Record
GHSA-f8qx-mjcq-wfgx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
CVE-2020-1597- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-f8qx-mjcq-wfgx
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka ASP.NET Core Denial of Service Vulnerability.
- Record
GHSA-f8qx-mjcq-wfgx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2020:3421
Red Hat Security Advisory: .NET Core 3.1 security and bugfix update for Red Hat Enterprise Linux
- Record
RHSA-2020:3421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3422
Red Hat Security Advisory: .NET Core 3.1 security and bugfix update
- Record
RHSA-2020:3422- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-aspnet-core-2020-1597 No score
ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
- Record
BIT-aspnet-core-2020-1597- Updated
- 2026-11-02
Affected products
- microsoft asp.net core
- microsoft asp.net core 2.1
- microsoft asp.net core 3.1
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)
- microsoft visual studio 2019 version 16.0
- microsoft visual studio 2019 version 16.4 (includes 16.0 - 16.3)
- microsoft visual studio 2019 version 16.7 (includes 16.0 – 16.6)
- microsoft visual studio 2017
- microsoft visual studio 2019
- fedoraproject fedora
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.AppNuGet |
2.1.0 up to 2.1.21 | 2.1.21 |
Microsoft.AspNetCore.AllNuGet |
2.1.0 up to 2.1.21 | 2.1.21 |
Microsoft.AspNetCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.7 | 3.1.7 |
aspnet-coreBitnami |
2.1.0 up to 2.1.1, 3.1.0 up to 3.1.1 | 2.1.13.1.1 |
Microsoft.AspNetCore.AppNuGet |
2.1.0 up to 2.1.21, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 15 moreShow less2.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.21 |
Microsoft.AspNetCore.AllNuGet |
2.1.0 up to 2.1.21, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 15 moreShow less2.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.21 |
Microsoft.AspNetCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.7, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.107-1.el7 | 0:3.1.107-1.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.107-1.el7 | 0:3.1.107-1.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.107-1.el7 | 0:3.1.107-1.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.7-1.el7 | 0:3.1.7-1.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.107-1.el7 | 0:3.1.107-1.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.107-1.el7 | 0:3.1.107-1.el7 |
aspnetcore-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
aspnetcore-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet-apphost-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-apphost-pack-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-hostRed Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-hostfxr-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-hostfxr-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-runtime-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-sdk-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet-sdk-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.7-1.el8_2 | 0:3.1.7-1.el8_2 |
dotnet-templates-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
dotnet3.1-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.107-1.el8_2 | 0:3.1.107-1.el8_2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1597 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published August 17, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.56%, the 93rd percentile. Fixed in Microsoft.AspNetCore.App 2.1.21.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1597
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW4CBI26KSO3PRL3HLVVISXPPOYUHSXO
nvd.nist.gov/vuln/detail/CVE-2020-1597
Show 10 moreShow less
github.com/dotnet/announcements/issues/162
access.redhat.com/errata/RHSA-2020:3421
bugzilla.redhat.com/show_bug.cgi?id=1861110
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3421.json
cve.org/CVERecord?id=CVE-2020-1597