{"id":"CVE-2022-26924","aliases":["EUVD-2022-1683","GHSA-8xc6-g8xw-h2c4"],"status":"published","title":"YARP Denial of Service Vulnerability","description":"YARP Denial of Service Vulnerability","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03511,"percentile":0.893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-15T19:06:04Z","modified":"2026-10-24T10:30:24Z","fixes":[{"ecosystem":"NuGet","package":"Yarp.ReverseProxy","fixed_in":["1.0.1","1.1.0-rc.1.22211.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-rc.1.22152.1"},{"last_affected":"1.1.0-rc.1.22152.1"},{"fixed":"1.1.0-rc.1.22211.2"}]}],"versions":["1.1.0-rc.1.22152.1"]},{"source":"osv","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-rc.1.22152.1"},{"fixed":"1.1.0-rc.1.22211.2"}]}],"versions":["1.1.0-rc.1.22152.1"]}],"products":[{"vendor":"microsoft","product":"yarp 1.0"},{"vendor":"microsoft","product":"yarp 1.1rc"},{"vendor":"microsoft","product":"yet_another_reverse_proxy"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-8xc6-g8xw-h2c4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26924","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26924","tags":["web"]},{"url":"https://github.com/microsoft/reverse-proxy/commit/11e6272da17beb03d0b44a19d3c4f1ffa52b7c38","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8xc6-g8xw-h2c4"},{"url":"https://github.com/microsoft/reverse-proxy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-26924","title":"YARP Denial of Service Vulnerability","description":"YARP Denial of Service Vulnerability","status":"published","published":"2022-04-15T19:06:04Z","modified":"2025-01-02T18:52:20.851Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-1683","description":"YARP Denial of Service Vulnerability","status":"published","published":"2022-04-15T19:06:04Z","modified":"2025-01-02T18:52:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T00:04:28.496186Z"}],"ghsa":[{"id":"GHSA-8xc6-g8xw-h2c4","title":"YARP Denial of Service Vulnerability","description":"### Impact\n\nA denial of service vulnerability exists in how YARP processes input.\n\n### Patches\n\nIf you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).\nIf you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n\u003cItemGroup\u003e\n- \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.0\" /\u003e\n- \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.0\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.1\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.1\" /\u003e\n\u003c/ItemGroup\u003e\n```\nor by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)\n\n### References\n\n[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)","status":"published","published":"2022-04-22T20:23:44Z","modified":"2023-01-27T05:02:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2022-26924","description":"YARP Denial of Service Vulnerability","status":"published","published":"2022-04-15T19:15:15.697Z","modified":"2026-06-17T04:36:08.127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"CVE-2022-26924","description":"YARP Denial of Service Vulnerability","status":"published","published":"2022-04-15T19:15:15.697Z","modified":"2026-10-24T10:30:24.361865985Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-8xc6-g8xw-h2c4","title":"YARP Denial of Service Vulnerability","description":"### Impact\n\nA denial of service vulnerability exists in how YARP processes input.\n\n### Patches\n\nIf you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).\nIf you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n\u003cItemGroup\u003e\n- \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.0\" /\u003e\n- \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.0\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.1\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.1\" /\u003e\n\u003c/ItemGroup\u003e\n```\nor by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)\n\n### References\n\n[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)","status":"published","published":"2022-04-22T20:23:44Z","modified":"2024-12-05T05:56:47.470573Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}