{
"id": "GHSA-cgpw-2gph-2r9g",
"aliases": [],
"details": "Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.\n\nThe update addresses the vulnerability by correcting how ASP.NET Core handles such requests.\n",
"summary": "Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.4"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.Server.Kestrel.Core",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.9"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.All",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.App",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.Server.Kestrel.Core",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
]
}
],
"package": {
"name": "Microsoft.AspNetCore.All",
"ecosystem": "NuGet"
}
}
],
"modified": "2021-12-03T14:28:10Z",
"severity": [],
"published": "2018-10-16T19:59:59Z",
"references": [
{
"url": "https://github.com/aspnet/Announcements/issues/311",
"type": "WEB"
},
{
"url": "https://github.com/advisories/GHSA-cgpw-2gph-2r9g",
"type": "ADVISORY"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:31:39Z"
}
}