CVE-2022-21986
published 2022-02-09CVE-2022-21986: .NET Denial of Service Vulnerability .NET Denial of Service Vulnerability
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.74%
88.6th percentile
.NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.osx-arm64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.osx-x64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.osx-x64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x64 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x64 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x86 | >= 5.0.0 < 5.0.14 | 5.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x86 | >= 6.0.0 < 6.0.2 | 6.0.2 |
| microsoft | microsoft_visual_studio_2019_version_16.11 | >= 16.11.0 < 16.11.10 | 16.11.10 |
| microsoft | microsoft_visual_studio_2019_version_16.9 | >= 15.0.0 < 16.9.17 | 16.9.17 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
cvelistv57.5HIGH
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service
vendor_redhat·2022-02-08·CVSS 7.5
CVE-2022-21986 [HIGH] CWE-770 dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service
dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service
.NET Denial of Service Vulnerability
A vulnerability was found in dotnet’s ASP.NET Core Krestel when pooling HTTP/2 and HTTP/3 headers. This flaw allows a remote, unauthenticated attacker to cause a denial of service.
Package: rh-dotnet31 (.NET Core 3.1 on Red Hat Enterprise Linux) - Not affected
Package: dotnet3.1 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet3.1 (Red Hat Enterprise Linux 9) - Not affected
Microsoft
.NET Denial of Service Vulnerability
vendor_msrc·2022-02-08·CVSS 7.5
CVE-2022-21986 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
FAQ: What .NET component is affected by this denial of service vulnerability?
This vulnerability affects applications that utilize the Kestrel web server when processing certain HTTP/2 and HTTP/3 requests.
Kestrel Web Server: Kestrel Web Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Remediation: Release Notes
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.9
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.
GHSA
.NET Denial of Service Vulnerability
ghsa·2022-10-21·CVSS 7.5
CVE-2022-21986 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 5.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A Denial of Service vulnerability exists in .NET 6.0 and .NET 5.0 when the Kestrel web server processes certain HTTP/2 and HTTP/3 requests.
### Affected Software
* Any .NET 6.0 application running on .NET 6.0.1 or lower.
* Any .NET 5.0 application running on .NET 5.0.13 or lower.
### Patches
To fix the issue, please install the latest version of .NET 6.0 or .NET 5.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your
OSV
.NET Denial of Service Vulnerability
osv·2022-10-21·CVSS 7.5
CVE-2022-21986 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 5.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A Denial of Service vulnerability exists in .NET 6.0 and .NET 5.0 when the Kestrel web server processes certain HTTP/2 and HTTP/3 requests.
### Affected Software
* Any .NET 6.0 application running on .NET 6.0.1 or lower.
* Any .NET 5.0 application running on .NET 5.0.13 or lower.
### Patches
To fix the issue, please install the latest version of .NET 6.0 or .NET 5.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your
CVEList
.NET Denial of Service Vulnerability
cvelistv5·2022-02-09·CVSS 7.5
CVE-2022-21986 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
No detection rules found.
No public exploits indexed.
2022-02-09
Published