GHSA-cgpw-2gph-2r9g
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core
Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.
The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.
What each source reports
GitHub AdvisoriesNo score
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core
Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.
The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.
- Record
GHSA-cgpw-2gph-2r9g- Updated
- 2026-11-02
OSVNo score
Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core
Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.
The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.
- Record
GHSA-cgpw-2gph-2r9g- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.0.0 up to 2.0.4 | 2.0.4 |
Microsoft.AspNetCore.AllNuGet | 2.0.0 up to 2.0.9 | 2.0.9 |
Microsoft.AspNetCore.AppNuGet | 2.1.0 up to 2.1.2 | 2.1.2 |
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.1.0 up to 2.1.2 | 2.1.2 |
Microsoft.AspNetCore.AllNuGet | 2.1.0 up to 2.1.2 | 2.1.2 |
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.0.0 up to 2.0.4, plus listed versions 2.0.12.0.22.0.3 | 2.0.4 |
Microsoft.AspNetCore.AllNuGet | 2.0.0 up to 2.0.9, plus listed versions 2.0.32.0.52.0.62.0.72.0.8 | 2.0.9 |
Microsoft.AspNetCore.AppNuGet | 2.1.0 up to 2.1.2, plus listed versions 2.1.1 | 2.1.2 |
Microsoft.AspNetCore.Server.Kestrel.CoreNuGet | 2.1.0 up to 2.1.2, plus listed versions 2.1.1 | 2.1.2 |
Microsoft.AspNetCore.AllNuGet | 2.1.0 up to 2.1.2, plus listed versions 2.1.1 | 2.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-cgpw-2gph-2r9g is a vulnerability with no CVSS score yet in Microsoft.AspNetCore.Server.Kestrel.Core, published October 16, 2018. No source lists public exploit code. Fixed in Microsoft.AspNetCore.Server.Kestrel.Core 2.0.4.