Iniciar sesión
Deutsch English Español Polski
Alta

.NET Denial of Service Vulnerability

  • Publicada: 15.09.2022
  • Actualizado: 11.10.2026 11:23

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding.

<a name="affected-software"></a>Affected software

  • Any .NET 6.0 application running on .NET 6.0.8 or earlier.
  • Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET.

<a name="ASP.NET Core 3.1"></a>.NET Core 3.1

Package name Affected version Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.linux-x64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.osx-x64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.win-arm >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.win-arm64 >= 3.1.5, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.win-x64 >= 3.1.0, < 3.1.29 3.1.29
Microsoft.AspNetCore.App.Runtime.win-x86 >= 3.1.0, < 3.1.29 3.1.29

<a name=".NET 6"></a>.NET 6

Package name Affected version Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 5.0.1, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.linux-x64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 6.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.osx-x64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.win-arm >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.win-arm64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.win-x64 >= 5.0.0, < 6.0.9 6.0.9
Microsoft.AspNetCore.App.Runtime.win-x86 >= 5.0.0, < 6.0.9 6.0.9

Other

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-arm >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 5.0.0, < 6.0.9 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.linux-x64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 5.0.0, < 6.0.9 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.osx-x64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.win-arm >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.win-arm64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.win-x64 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
.NET (NuGet) Microsoft.AspNetCore.App.Runtime.win-x86 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9

Referencias

Puntuación CVSS 7.5/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE)
CWE-400
Plataforma
.NET (NuGet)
Paquete
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm
Publicada
15.09.2022
Actualizado
11.10.2026 11:23

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-r8m2-4x37-6592 - CC BY 4.0

Historial de vulnerabilidades: Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Todas las vulnerabilidades publicadas de este paquete (.NET (NuGet)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (25) en el archivo
Entradas en total
25
Primera → última
05.2022 10.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 3
  • Alta 19
  • Media 3

Divulgaciones por año

Gravedad:
  1. Aviso de seguridad de Microsoft CVE-2026-70186 - Vulnerabilidad de denegación de servicio en ASP.NET Core
    Alta · 7.5 CVE-2026-70186 >= 8.0.0, < 8.0.32, >= 10.0.0, < 10.0.13, >= 9.0.0, < 9.0.21 8.0.32, 10.0.13, 9.0.21
  2. Aviso de seguridad de Microsoft CVE-2026-88092 - Vulnerabilidad de elusión de funciones de seguridad de ASP.NET Core
    Crítica · 9.4 CVE-2026-88092 >= 8.0.0, < 8.0.32, >= 10.0.0, < 10.0.13, >= 11.0.0-preview.1, < 11.0.0-rc.2, >= 9.0.0, < 9.0.21 8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
  3. Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2026-56170 >= 10.0.0, < 10.0.6, >= 9.0.0, < 9.0.15, >= 8.0.0, < 8.0.26 10.0.6, 9.0.15, 8.0.26
  4. Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
    Alta · 7.5 CVE-2026-42899 >= 8.0.0, < 8.0.27, >= 10.0.0, < 10.0.8, >= 9.0.0, < 9.0.16 8.0.27, 10.0.8, 9.0.16
  5. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2026-26130 >= 8.0.0, < 8.0.25, >= 9.0.0, < 9.0.14, >= 10.0.0, < 10.0.4 8.0.25, 9.0.14, 10.0.4
  6. Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
    Crítica · 9.9 CVE-2025-55315 >= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107, >= 9.0.0, < 9.0.10, >= 8.0.0, < 8.0.21 10.0.0-rc.2.25502.107, 9.0.10, 8.0.21
  7. Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
    Alta · 7.0 CVE-2025-24070 >= 9.0.0, < 9.0.3, >= 8.0.0, < 8.0.14, >= 6.0.0, <= 6.0.36 9.0.3, 8.0.14
  8. Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability
    Alta · 8.1 CVE-2024-38229 >= 9.0.0-preview.1.24081.5, < 9.0.0-rc.2.24474.3, >= 8.0.0, < 8.0.10 9.0.0-rc.2.24474.3, 8.0.10
  9. Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability
    Crítica · 8.1 CVE-2024-35264 >= 8.0.0, < 8.0.7 8.0.7
  10. Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2024-21386 < 6.0.27, >= 7.0.0, < 7.0.16, >= 8.0.0, < 8.0.2 6.0.27, 7.0.16, 8.0.2
  11. Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability
    Alta · 8.1 CVE-2023-33170 >= 7.0.0, < 7.0.9, < 6.0.20 7.0.9, 6.0.20
  12. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2022-23267 >= 3.0.0, < 3.1.25, >= 5.0.0, < 5.0.17, >= 6.0.0, < 6.0.5 3.1.25, 5.0.17, 6.0.5
  13. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2022-24464 >= 3.0.0, < 3.1.23, >= 5.0.0, < 5.0.15, >= 6.0.0, < 6.0.3 3.1.23, 5.0.15, 6.0.3
  14. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2022-21986 >= 5.0.0, < 5.0.14, >= 6.0.0, < 6.0.2 5.0.14, 6.0.2
  15. .NET Denial of Service Vulnerability esta entrada
    Alta · 7.5 CVE-2022-38013 >= 3.1.0, < 3.1.29, >= 5.0.0, < 6.0.9 3.1.29, 6.0.9
  16. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2022-29145 >= 3.0.0, < 3.1.25, >= 5.0.0, < 5.0.17, >= 6.0.0, < 6.0.5 3.1.25, 5.0.17, 6.0.5
  17. .NET Denial of Service Vulnerability
    Alta · 7.5 CVE-2022-29117 >= 3.0.0, < 3.1.25, >= 5.0.0, < 5.0.17, >= 6.0.0, < 6.0.5 3.1.25, 5.0.17, 6.0.5
  18. ASP.NET Core and Visual Studio Denial of Service Vulnerability
    Alta · 7.5 CVE-2021-1723 >= 3.1.0, < 3.1.11, >= 5.0.0, < 5.0.2 3.1.11, 5.0.2
  19. Cookie parsing failure
    Alta · 7.5 CVE-2020-1045 >= 3.1.0, < 3.1.8 3.1.8
  20. ASP.NET Core Denial of Service Vulnerability
    Alta · 7.5 CVE-2020-1597 >= 3.1.0, < 3.1.7 3.1.7
  21. ASP.NET Core Denial of Service Vulnerability
    Alta · 7.5 CVE-2020-1161 >= 3.1.0, < 3.1.4 3.1.4
  22. Remote code execution in ASP.NET Core
    Alta CVE-2020-0603 >= 3.1.0, < 3.1.1 3.1.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.