CVE-2019-0657

Improper Input Validation in .Net Framework API's

5.9 MediumFix available

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

4.55%Down 4.2 points since Apr 14, 2021

What each source reports

NVD Score used 5.9

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: CVE-2019-0657
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: CVE-2019-0657
Updated: 2026-11-02

EUVDEUVD-2022-5721 No score

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: EUVD-2022-5721
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x5qj-9vmx-7g6g 5.9

Improper Input Validation in .Net Framework API's

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: GHSA-x5qj-9vmx-7g6g
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 5.9

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: CVE-2019-0657
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-x5qj-9vmx-7g6g 5.9

Improper Input Validation in .Net Framework API's

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Record: GHSA-x5qj-9vmx-7g6g
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVRHSA-2019:0349 7.5

Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update for February 2019

Record: RHSA-2019:0349
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.NETCore.App` NuGet	2.2.0 up to 2.2.2	2.2.2
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.8	2.1.8
`System.Private.Uri` NuGet	4.3.0 up to 4.3.2	4.3.2
`Microsoft.NETCore.App` NuGet	2.2.0 up to 2.2.2, plus listed versions 2.2.1	2.2.2
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.8, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.62.1.7	2.1.8
`System.Private.Uri` NuGet	4.3.0 up to 4.3.2, plus listed versions 4.3.1	4.3.2
`rh-dotnetcore10-dotnetcore` Red Hat:rhel_dotnet:1.0::el7	before 0:1.0.14-1.el7	0:1.0.14-1.el7
`rh-dotnetcore10-dotnetcore-debuginfo` Red Hat:rhel_dotnet:1.0::el7	before 0:1.0.14-1.el7	0:1.0.14-1.el7
`rh-dotnetcore11-dotnetcore` Red Hat:rhel_dotnet:1.1::el7	before 0:1.1.11-2.el7	0:1.1.11-2.el7
`rh-dotnetcore11-dotnetcore-debuginfo` Red Hat:rhel_dotnet:1.1::el7	before 0:1.1.11-2.el7	0:1.1.11-2.el7

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`rh-dotnet21` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-7.el7	0:2.1-7.el7
`rh-dotnet21-dotnet` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.504-1.el7	0:2.1.504-1.el7
`rh-dotnet21-dotnet-debuginfo` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.504-1.el7	0:2.1.504-1.el7
`rh-dotnet21-dotnet-host` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.8-1.el7	0:2.1.8-1.el7
`rh-dotnet21-dotnet-runtime-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.8-1.el7	0:2.1.8-1.el7
`rh-dotnet21-dotnet-sdk-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.504-1.el7	0:2.1.504-1.el7
`rh-dotnet21-dotnet-sdk-2.1.5xx` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.504-1.el7	0:2.1.504-1.el7
`rh-dotnet21-runtime` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-7.el7	0:2.1-7.el7
`rh-dotnet22` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2-3.el7	0:2.2-3.el7
`rh-dotnet22-dotnet` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.104-2.el7	0:2.2.104-2.el7
`rh-dotnet22-dotnet-debuginfo` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.104-2.el7	0:2.2.104-2.el7
`rh-dotnet22-dotnet-host` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.2-2.el7	0:2.2.2-2.el7
`rh-dotnet22-dotnet-host-fxr-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.2-2.el7	0:2.2.2-2.el7
`rh-dotnet22-dotnet-runtime-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.2-2.el7	0:2.2.2-2.el7
`rh-dotnet22-dotnet-sdk-2.2` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.104-2.el7	0:2.2.104-2.el7
`rh-dotnet22-dotnet-sdk-2.2.1xx` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2.104-2.el7	0:2.2.104-2.el7
`rh-dotnet22-runtime` Red Hat:rhel_dotnet:2.2::el7	before 0:2.2-3.el7	0:2.2-3.el7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-0657 is a medium vulnerability (CVSS 5.9) in Microsoft .net Framework, published March 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.55%, the 91st percentile. Fixed in Microsoft.NETCore.App 2.2.2.

References

Show 6 moreShow less