Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-242j-2gm6-5rwx

GitHub Security Advisory

ASP.NET Core and Visual Studio Denial of Service Vulnerability

✓ GitHub Reviewed HIGH Has CVE
View on GitHub

Advisory Details

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.

Affected Packages

NuGet Microsoft.AspNetCore.Server.Kestrel.Core
Affected versions: 0 (fixed in 2.1.25)
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.win-arm
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.win-arm
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.win-x64
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.win-x64
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.win-x86
Affected versions: 3.1.0 (fixed in 3.1.11)
NuGet Microsoft.AspNetCore.App.Runtime.win-x86
Affected versions: 5.0.0 (fixed in 5.0.2)
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm
Affected versions: 5.0.1 (fixed in 5.0.2)

Related CVEs

CVE-2021-1723

Key Information

GHSA ID
GHSA-242j-2gm6-5rwx
Published
May 24, 2022 5:38 PM
Last Modified
October 9, 2024 6:33 PM
CVSS Score
7.5 /10
Primary Ecosystem
NuGet
Primary Package
Microsoft.AspNetCore.Server.Kestrel.Core
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 12, 2025 6:24 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.