CVE-2023-38180 Microsoft .NET Core and Visual Studio Denial-of-Service
Attackers can cause a denial of service in .NET and Visual Studio environments, requiring users to apply vendor patches.
- Exploited in the wild
- Since 9 Aug 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38180?
CVE-2023-38180 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
.NET and Visual Studio Denial of Service Vulnerability
Weakness: CWE-400
Which versions are affected by CVE-2023-38180?
21 open source packages ship an affected version, including Microsoft.AspNetCore.App.Runtime.win-arm64, aspnet-core and dotnet. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet | From 7.0.0 | 7.0.10 |
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet | From 7.0.0 | 7.0.10 |
aspnet-core Bitnami | From 2.1.0 | 2.1.40 |
dotnet Bitnami | From 6.0.0 | 6.0.21, 7.0.10 |
15 more packages
dotnet-sdk Bitnami | From 6.0.0 | 6.0.21, 7.0.10 |
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet | From 7.0.0 | 7.0.10 |
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet | From 7.0.0 | 7.0.10 |
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet | From 7.0.0 | 7.0.10 |
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet | From 7.0.0 | 7.0.10 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv NuGet | All versions | 2.1.40 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv NuGet | All versions | 2.1.40 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv NuGet | From 6.0.0 | 6.0.21 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets NuGet | All versions | 2.1.40 |
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets NuGet | All versions | 2.1.40 |
Products include Fedoraproject Fedora, Microsoft .Net, Microsoft Asp.net Core, Microsoft Visual Studio 2022.
How do I fix CVE-2023-38180?
Upgrade Microsoft.AspNetCore.App.Runtime.win-arm64 to a fixed version for your release line: 6.0.21 or 7.0.10. US federal agencies must fix it by 30 Aug 2023.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38180 being exploited?
Yes. Attackers have exploited CVE-2023-38180 in the wild since at least 9 Aug 2023.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-aspnet-core-2023-38180, BIT-dotnet-2023-38180, BIT-dotnet-sdk-2023-38180, CLEANSTART-2025-MR09563, GHSA-vmch-3w2x-vhgq, UBUNTU-CVE-2023-38180.