{"id":"GHSA-cgpw-2gph-2r9g","summary":"Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core","details":"Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.\n\nThe update addresses the vulnerability by correcting how ASP.NET Core handles such requests.\n","modified":"2024-12-02T05:46:46.432090Z","published":"2018-10-16T19:59:59Z","database_specific":{"github_reviewed_at":"2020-06-16T21:31:39Z","nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/aspnet/Announcements/issues/311"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cgpw-2gph-2r9g"}],"affected":[{"package":{"name":"Microsoft.AspNetCore.Server.Kestrel.Core","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-cgpw-2gph-2r9g/GHSA-cgpw-2gph-2r9g.json"}},{"package":{"name":"Microsoft.AspNetCore.All","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.All"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9"}]}],"versions":["2.0.0","2.0.3","2.0.5","2.0.6","2.0.7","2.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-cgpw-2gph-2r9g/GHSA-cgpw-2gph-2r9g.json"}},{"package":{"name":"Microsoft.AspNetCore.App","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-cgpw-2gph-2r9g/GHSA-cgpw-2gph-2r9g.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.Kestrel.Core","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-cgpw-2gph-2r9g/GHSA-cgpw-2gph-2r9g.json"}},{"package":{"name":"Microsoft.AspNetCore.All","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.All"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-cgpw-2gph-2r9g/GHSA-cgpw-2gph-2r9g.json"}}],"schema_version":"1.9.0"}