CVE-2019-0981 — Uncontrolled Resource Consumption in Microsoft NET Framework 2.0

CWE-400 — Uncontrolled Resource ConsumptionCWE-835 — Infinite LoopCWE-1333 — Regex Denial of Service11 documents7 sources
Severity
7.5HIGHNVD
EPSS
3.2%
top 12.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
40
Microsoft NET Framework 2.0Microsoft NET Framework 3.0Microsoft NET Framework 3.5+37 more
Timeline
PublishedMay 16
Latest updateMay 24

Description

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages41 packages

▶CVEListV5microsoft/net_core4 versions+3
▶NVDmicrosoft/net_core4 versions+3

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
OSV
Denial of service in ASP.NET Core↗2022-05-24
▶
GHSA
Denial of service in ASP.NET Core↗2022-05-24
▶
GHSA
Denial of service in ASP.NET Core↗2022-05-24
▶
GHSA
Regular Expression Denial of Service in System.Text.RegularExpressions↗2021-08-04
▶
CVEList
CVE-2019-0981: A denial of service vulnerability exists when↗2019-05-16
▶

📋Vendor Advisories

4
Microsoft
.Net Framework and .Net Core Denial of Service Vulnerability↗2019-05-14
▶
Red Hat
dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service↗2019-05-14
▶
Red Hat
dotnet: timeouts for regular expressions are not enforced↗2019-05-14
▶
Red Hat
dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service↗2019-05-14
▶

💬Community

1
Bugzilla
CVE-2019-0981 dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service↗2019-05-02
▶
CVE-2019-0981 — Uncontrolled Resource Consumption | cvebase