{"id":"CVE-2024-20672","aliases":["ALPINE-CVE-2024-20672","BELL-CVE-2024-20672","BIT-dotnet-2024-20672","BIT-dotnet-sdk-2024-20672","EUVD-2024-18387","GHSA-rh83-2fx8-8x6x"],"status":"published","title":".NET Denial of Service Vulnerability","description":".NET Denial of Service Vulnerability","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02895,"percentile":0.87122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-01-09T17:56:58Z","modified":"2026-11-03T06:32:49Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"dotnet6-build","fixed_in":["6.0.131-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dotnet6-build","fixed_in":["6.0.131-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dotnet6-runtime","fixed_in":["6.0.31-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dotnet6-runtime","fixed_in":["6.0.31-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dotnet7-build","fixed_in":["7.0.120-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dotnet7-runtime","fixed_in":["7.0.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dotnet8-runtime","fixed_in":["8.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dotnet8-runtime","fixed_in":["8.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","fixed_in":["8.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","fixed_in":["8.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","fixed_in":["8.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dotnet6-build","fixed_in":["6.0.131-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dotnet6-runtime","fixed_in":["6.0.31-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["6.0.26","7.0.15"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["6.0.26","7.0.15"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet6-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.131-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dotnet6-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.131-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet6-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.31-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dotnet6-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.31-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.120-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dotnet6-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.125-r0"},{"fixed":"6.0.131-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dotnet6-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.25-r0"},{"fixed":"6.0.31-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.26"},{"introduced":"7.0.0"},{"fixed":"7.0.15"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.26"},{"introduced":"7.0.0"},{"fixed":"7.0.15"}]}]}],"products":[{"vendor":"microsoft","product":".net"},{"vendor":"microsoft","product":".net 6.0"},{"vendor":"microsoft","product":".net 7.0"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20672","tags":["vendor-advisory","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0006/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20672","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0006"},{"url":"https://github.com/advisories/GHSA-rh83-2fx8-8x6x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-20672","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-20672","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-20672","title":".NET Denial of Service Vulnerability","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-01-09T17:56:58.29Z","modified":"2025-06-03T14:30:36.844Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:56.868512Z"}],"euvd":[{"id":"EUVD-2024-18387","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-01-09T17:56:58Z","modified":"2025-06-03T14:30:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:32:31.558173Z"}],"ghsa":[{"id":"GHSA-rh83-2fx8-8x6x","title":".NET Core and Visual Studio Denial of Service Vulnerability","description":".NET Core and Visual Studio Denial of Service Vulnerability","status":"published","published":"2024-01-09T18:30:28Z","modified":"2025-03-28T15:32:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:00:30.942475Z"}],"nvd":[{"id":"CVE-2024-20672","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-01-09T18:15:50.243Z","modified":"2026-06-17T07:07:35.867Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"ALPINE-CVE-2024-20672","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-01-09T18:15:50.243Z","modified":"2026-11-03T06:32:49.228507008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"BELL-CVE-2024-20672","status":"published","published":"2024-01-09T18:15:50.243Z","modified":"2026-01-26T09:42:49.403335Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-20672","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-01-09T18:15:50.243Z","modified":"2026-10-24T10:30:37.095893456Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"BIT-dotnet-2024-20672","title":".NET Denial of Service Vulnerability","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-03-06T10:51:30.677Z","modified":"2026-09-08T08:46:56.489991457Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2024-20672","title":".NET Denial of Service Vulnerability","description":".NET Denial of Service Vulnerability","status":"published","published":"2024-03-06T10:51:24.496Z","modified":"2026-09-08T08:46:43.433326798Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}