{
"id": "GHSA-3m2r-q8x3-xmf7",
"aliases": [],
"details": "Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.\n",
"summary": "Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.Server.Kestrel.Core",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.8"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.All",
"ecosystem": "NuGet"
}
}
],
"modified": "2021-12-03T14:27:36Z",
"severity": [],
"published": "2018-10-16T19:59:48Z",
"references": [
{
"url": "https://github.com/aspnet/Announcements/issues/300",
"type": "WEB"
},
{
"url": "https://github.com/advisories/GHSA-3m2r-q8x3-xmf7",
"type": "ADVISORY"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T20:55:28Z"
}
}