{"id":"CVE-2023-33141","aliases":["EUVD-2023-1836","GHSA-jrjw-qgr2-wfcg"],"status":"published","title":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","description":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0222,"percentile":0.82804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-06-23T01:25:57Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"NuGet","package":"Yarp.ReverseProxy","fixed_in":["1.1.2","2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1"},{"fixed":"1.1.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"Yarp.ReverseProxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]}],"products":[{"vendor":"microsoft","product":"yarp 1.0"},{"vendor":"microsoft","product":"yarp 2.0"},{"vendor":"microsoft","product":"yet_another_reverse_proxy"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141","tags":["vendor-advisory","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-jrjw-qgr2-wfcg","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33141","tags":["advisory"]},{"url":"https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2","tags":["web"]},{"url":"https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jrjw-qgr2-wfcg"},{"url":"https://github.com/microsoft/reverse-proxy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-33141","title":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","description":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","status":"published","published":"2023-06-23T01:25:57.903Z","modified":"2025-01-01T01:44:16.872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-1836","description":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","status":"published","published":"2023-06-23T01:25:57Z","modified":"2025-01-01T01:44:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T00:04:30.464531Z"}],"ghsa":[{"id":"GHSA-jrjw-qgr2-wfcg","title":"YARP Denial of Service Vulnerability","description":"### Impact\nA denial of service vulnerability exists in YARP.\n\n### Patches\nIf you're using YARP 1.x, you should update to NuGet package version [1.1.2](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2).\nIf you're using YARP 2.0.0, you should update to NuGet package version [2.0.1](https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1).\n\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n\u003cItemGroup\u003e\n- \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.0\" /\u003e\n- \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.0\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.1\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.1\" /\u003e\n\u003c/ItemGroup\u003e\n```\nor by selecting `2.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n\n### References\n\n[CVE-2023-33141](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141)\n","status":"published","published":"2023-06-23T21:37:26Z","modified":"2024-06-03T18:29:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:53.025064Z"}],"nvd":[{"id":"CVE-2023-33141","description":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","status":"published","published":"2023-06-23T02:15:09.513Z","modified":"2026-06-17T06:01:08.55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"CVE-2023-33141","description":"Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability","status":"published","published":"2023-06-23T02:15:09.513Z","modified":"2026-10-24T10:30:44.830959641Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"GHSA-jrjw-qgr2-wfcg","title":"YARP Denial of Service Vulnerability","description":"### Impact\nA denial of service vulnerability exists in YARP.\n\n### Patches\nIf you're using YARP 1.x, you should update to NuGet package version [1.1.2](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2).\nIf you're using YARP 2.0.0, you should update to NuGet package version [2.0.1](https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1).\n\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n\u003cItemGroup\u003e\n- \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.0\" /\u003e\n- \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.0\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.1\" /\u003e\n+ \u003cPackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.1\" /\u003e\n\u003c/ItemGroup\u003e\n```\nor by selecting `2.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n\n### References\n\n[CVE-2023-33141](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141)\n","status":"published","published":"2023-06-23T21:37:26Z","modified":"2024-06-03T18:49:04.003006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}