GHSA-3m2r-q8x3-xmf7
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv
GHSA-3m2r-q8x3-xmf7 is a vulnerability with no CVSS score yet in Microsoft.AspNetCore.Server.Kestrel.Core, published October 16, 2018. No source lists public exploit code. Fixed in Microsoft.AspNetCore.Server.Kestrel.Core 2.0.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.3Microsoft.AspNetCore.Server.Kestrel.Core +7 more
Description
Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.0.0 up to 2.0.3 | 2.0.3 |
Microsoft.AspNetCore.Server.Kestrel.Transport.AbstractionsNuGet | 2.0.0 up to 2.0.3 | 2.0.3 |
Microsoft.AspNetCore.Server.Kestrel.Transport.LibuvNuGet | 2.0.0 up to 2.0.3 | 2.0.3 |
Microsoft.AspNetCore.AllNuGet | 2.0.0 up to 2.0.8 | 2.0.8 |
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 | 2.0.3 |
Microsoft.AspNetCore.Server.Kestrel.Transport.AbstractionsNuGet | 2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 | 2.0.3 |
Microsoft.AspNetCore.Server.Kestrel.Transport.LibuvNuGet | 2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 | 2.0.3 |
Microsoft.AspNetCore.AllNuGet | 2.0.0 up to 2.0.8, plus listed versions 2.0.32.0.52.0.62.0.7 | 2.0.8 |
What each source reports
GitHub AdvisoriesNo score
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv
Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.
- Record
GHSA-3m2r-q8x3-xmf7- Updated
- 2026-11-02
OSVNo score
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv
Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.
- Record
GHSA-3m2r-q8x3-xmf7- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.