{"id":"CVE-2017-0247","aliases":["EUVD-2018-0527","GHSA-6xh7-4v2w-36q6"],"status":"published","title":"ASP.NET Core fails to properly validate web requests","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.16911,"percentile":0.97074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-05-12T14:00:00Z","modified":"2026-06-17T00:57:20Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","fixed_in":["1.1.3","1.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http","fixed_in":["4.1.2","4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Text.Encodings.Web","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","fixed_in":["4.0.1","4.5.4"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Security","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.WebSockets.Client","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.5.4"}]}],"versions":["4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","4.4.0-preview1-25305-02","4.4.0-preview2-25405-01","4.5.0","4.5.0-preview1-26216-02","4.5.0-preview2-26406-04","4.5.0-rc1","4.5.1","4.5.2","4.5.2-servicing-27114-05","4.5.3"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]}],"products":[{"vendor":"microsoft","product":"asp.net core"},{"vendor":"microsoft","product":"asp.net_model_view_controller"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.abstractions"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.apiexplorer"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.cors"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.dataannotations"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.json"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.xml"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.localization"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor.host"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.taghelpers"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.viewfeatures"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.webapicompatshim"},{"vendor":"microsoft","product":"system.net.http"},{"vendor":"microsoft","product":"system.net.http.winhttphandler"},{"vendor":"microsoft","product":"system.net.security"},{"vendor":"microsoft","product":"system.net.websockets.client"},{"vendor":"microsoft","product":"system.text.encodings.web"},{"vendor":"microsoft corporation","product":"asp.net core"}],"references":[{"url":"https://technet.microsoft.com/en-us/library/security/4021279.aspx","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://github.com/aspnet/Announcements/issues/239","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0247","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6xh7-4v2w-36q6","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-0247","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19.171Z","updated_at":"2026-11-02T14:33:22.699876Z"}],"euvd":[{"id":"EUVD-2018-0527","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19Z","updated_at":"2026-11-03T02:39:24.815554Z"}],"ghsa":[{"id":"GHSA-6xh7-4v2w-36q6","title":"ASP.NET Core fails to properly validate web requests","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","status":"published","published":"2018-10-16T19:58:05Z","modified":"2023-02-01T05:03:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2017-0247","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","status":"published","published":"2017-05-12T14:29:03.91Z","modified":"2026-06-17T00:57:20.26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"GHSA-6xh7-4v2w-36q6","title":"ASP.NET Core fails to properly validate web requests","description":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","status":"published","published":"2018-10-16T19:58:05Z","modified":"2023-11-08T03:58:40.064574Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}