{"id":"GHSA-cgpw-2gph-2r9g","aliases":[],"status":"published","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core","description":"Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.\n\nThe update addresses the vulnerability by correcting how ASP.NET Core handles such requests.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-10-16T19:59:59Z","modified":"2024-12-02T05:46:46Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","fixed_in":["2.0.4","2.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","fixed_in":["2.0.9","2.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App","fixed_in":["2.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9"}]}],"versions":["2.0.0","2.0.3","2.0.5","2.0.6","2.0.7","2.0.8"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.All","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"]}],"references":[{"url":"https://github.com/aspnet/Announcements/issues/311","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cgpw-2gph-2r9g","tags":["advisory"]}],"sources":{"ghsa":[{"id":"GHSA-cgpw-2gph-2r9g","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core","description":"Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.\n\nThe update addresses the vulnerability by correcting how ASP.NET Core handles such requests.\n","status":"published","published":"2018-10-16T19:59:59Z","modified":"2023-01-09T05:02:51Z","updated_at":"2026-11-02T14:36:03.768255Z"}],"osv":[{"id":"GHSA-cgpw-2gph-2r9g","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core","description":"Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.\n\nThe update addresses the vulnerability by correcting how ASP.NET Core handles such requests.\n","status":"published","published":"2018-10-16T19:59:59Z","modified":"2024-12-02T05:46:46.43209Z","updated_at":"2026-11-02T15:46:44.927642Z"}]}}