{"id":"GHSA-3m2r-q8x3-xmf7","summary":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","details":"Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.\n","modified":"2024-12-02T05:42:57.845950Z","published":"2018-10-16T19:59:48Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-06-16T20:55:28Z"},"references":[{"type":"WEB","url":"https://github.com/aspnet/Announcements/issues/300"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3m2r-q8x3-xmf7"}],"affected":[{"package":{"name":"Microsoft.AspNetCore.Server.Kestrel.Core","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-3m2r-q8x3-xmf7/GHSA-3m2r-q8x3-xmf7.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-3m2r-q8x3-xmf7/GHSA-3m2r-q8x3-xmf7.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.1","2.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-3m2r-q8x3-xmf7/GHSA-3m2r-q8x3-xmf7.json"}},{"package":{"name":"Microsoft.AspNetCore.All","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.All"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}],"versions":["2.0.0","2.0.3","2.0.5","2.0.6","2.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-3m2r-q8x3-xmf7/GHSA-3m2r-q8x3-xmf7.json"}}],"schema_version":"1.9.0"}