GHSA-cgpw-2gph-2r9g Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated.
An attacker can cause a denial of service in ASP.NET Core by sending a malformed request, requiring a patch to fix request handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cgpw-2gph-2r9g?
GHSA-cgpw-2gph-2r9g is a denial of service vulnerability in Microsoft.AspNetCore.All, published on 16 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.
The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.
Which versions are affected by GHSA-cgpw-2gph-2r9g?
10 open source packages ship an affected version, including Microsoft.AspNetCore.All, Microsoft.AspNetCore.App and Microsoft.AspNetCore.Server.Kestrel.Core.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.AspNetCore.All NuGet | From 2.0.0 | 2.0.9 |
Microsoft.AspNetCore.All NuGet | From 2.0.0 | 2.0.9 |
Microsoft.AspNetCore.All NuGet | From 2.1.0 | 2.1.2 |
Microsoft.AspNetCore.All NuGet | From 2.1.0 | 2.1.2 |
Microsoft.AspNetCore.App NuGet | From 2.1.0 | 2.1.2 |
Microsoft.AspNetCore.App NuGet | From 2.1.0 | 2.1.2 |
4 more packages
Microsoft.AspNetCore.Server.Kestrel.Core NuGet | From 2.0.0 | 2.0.4 |
Microsoft.AspNetCore.Server.Kestrel.Core NuGet | From 2.0.0 | 2.0.4 |
Microsoft.AspNetCore.Server.Kestrel.Core NuGet | From 2.1.0 | 2.1.2 |
Microsoft.AspNetCore.Server.Kestrel.Core NuGet | From 2.1.0 | 2.1.2 |
How do I fix GHSA-cgpw-2gph-2r9g?
Upgrade Microsoft.AspNetCore.All to a fixed version for your release line: 2.0.9 or 2.1.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-cgpw-2gph-2r9g being exploited?
There is no known exploitation of GHSA-cgpw-2gph-2r9g in the wild and no public exploit code.