{"id":"GHSA-3m2r-q8x3-xmf7","aliases":[],"status":"published","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","description":"Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-10-16T19:59:48Z","modified":"2024-12-02T05:42:57Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","fixed_in":["2.0.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}],"versions":["2.0.0","2.0.3","2.0.5","2.0.6","2.0.7"]}],"references":[{"url":"https://github.com/aspnet/Announcements/issues/300","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3m2r-q8x3-xmf7","tags":["advisory"]}],"sources":{"ghsa":[{"id":"GHSA-3m2r-q8x3-xmf7","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","description":"Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.\n","status":"published","published":"2018-10-16T19:59:48Z","modified":"2023-01-09T05:02:39Z","updated_at":"2026-11-02T14:36:03.768255Z"}],"osv":[{"id":"GHSA-3m2r-q8x3-xmf7","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","description":"Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.\n","status":"published","published":"2018-10-16T19:59:48Z","modified":"2024-12-02T05:42:57.84595Z","updated_at":"2026-11-02T15:46:35.747385Z"}]}}