CVE-2020-1108 .NET Core & .NET Framework Denial of Service Vulnerability
Remote unauthenticated attackers can cause denial of service in .NET web applications by sending specially crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1108?
CVE-2020-1108 is a high-severity denial of service vulnerability in Microsoft .Net, published on 21 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
Which versions are affected by CVE-2020-1108?
27 open source packages ship an affected version, including Microsoft.NETCore.App, dotnet and dotnet-sdk. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.NETCore.App NuGet | From 2.1.0 | 2.1.18 |
Microsoft.NETCore.App NuGet | From 2.1.0 | 2.1.18 |
dotnet Bitnami | From 5.0-preview1.0 to 5.0-preview1.0 | None |
dotnet-sdk Bitnami | From 5.0-preview1.0 to 5.0-preview1.0 | None |
powershell Bitnami | From 7.0.0 to 7.0.0 | None |
Microsoft.NETCore.App.Runtime.linux-arm NuGet | From 3.1.0 | 3.1.4 |
21 more packages
Microsoft.NETCore.App.Runtime.linux-arm NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.osx-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.osx-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.rhel.6-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.rhel.6-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-x86 NuGet | From 3.1.0 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-x86 NuGet | From 3.1.0 | 3.1.4 |
Linux distribution packages (13)
aspnetcore-runtime-3.1 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
aspnetcore-targeting-pack-3.1 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
dotnet Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.514-2.el8_2 |
dotnet Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.515-1.el8_2 |
dotnet Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.105-2.el8_2 |
dotnet-apphost-pack-3.1 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
dotnet-apphost-pack-3.1-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
dotnet-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.514-2.el8_2 |
dotnet-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.515-1.el8_2 |
dotnet-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.514-2.el8_2 |
dotnet-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.1.515-1.el8_2 |
dotnet-host Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
dotnet-host-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.1.5-2.el8_2 |
Products include Microsoft .Net, Microsoft .Net Core, Microsoft .Net Framework, Microsoft Powershell, Microsoft Powershell Core, Microsoft Visual Studio 2017 and 1 more.
How do I fix CVE-2020-1108?
Upgrade Microsoft.NETCore.App to 2.1.18 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-1108 being exploited?
There is no known exploitation of CVE-2020-1108 in the wild and no public exploit code.
Other vulnerabilities in Microsoft .Net
- CVE-2024-43498 .NET and Visual Studio Remote Code Execution Vulnerability
- CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
- CVE-2026-96957 .NET Security Feature Bypass Vulnerability
- CVE-2026-69439 .NET and Visual Studio Elevation of Privilege Vulnerability
- CVE-2026-71328 .NET and Visual Studio Remote Code Execution Vulnerability
Sources
Also known as BIT-dotnet-2020-1108, BIT-dotnet-sdk-2020-1108, BIT-powershell-2020-1108, GHSA-3w5p-jhp5-c29q, RHSA-2020:2143, RHSA-2020:2146 and 4 more.