CVE-2023-38180
published 2023-08-08CVE-2023-38180: .NET and Visual Studio Denial of Service Vulnerability
PriorityP273high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2023-08-30
Exploited in the wild
EPSS
14.69%
96.3th percentile
.NET and Visual Studio Denial of Service Vulnerability
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| microsoft | asp.net_core | >= 2.1 < 2.1.40 | 2.1.40 |
| microsoft | asp.net_core_2.1 | >= 2.0 < 2.1.40 | 2.1.40 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm64 | >= 6.0.0 < 6.0.21 | 6.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm64 | >= 7.0.0 < 7.0.10 | 7.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x64 | >= 6.0.0 < 6.0.21 | 6.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x64 | >= 7.0.0 < 7.0.10 | 7.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x86 | >= 6.0.0 < 6.0.21 | 6.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x86 | >= 7.0.0 < 7.0.10 | 7.0.10 |
| microsoft | microsoft_visual_studio_2022_version_17.2 | >= 17.2.0 < 17.2.18 | 17.2.18 |
| microsoft | microsoft_visual_studio_2022_version_17.4 | >= 17.4.0 < 17.4.10 | 17.4.10 |
| microsoft | microsoft_visual_studio_2022_version_17.6 | >= 17.6.0 < 17.6.6 | 17.6.6 |
| microsoft | net | >= 6.0.0 < 6.0.21 | 6.0.21 |
| microsoft | net | >= 7.0.0 < 7.0.10 | 7.0.10 |
| microsoft | net_6.0 | >= 6.0.0 < 6.0.21 | 6.0.21 |
| microsoft | net_7.0 | >= 7.0.0 < 7.0.10 | 7.0.10 |
| microsoft | visual_studio_2022 | >= 17.2.0 < 17.2.18 | 17.2.18 |
| microsoft | visual_studio_2022 | >= 17.4.0 < 17.4.10 | 17.4.10 |
| microsoft | visual_studio_2022 | >= 17.6.0 < 17.6.6 | 17.6.6 |
| msrc | asp.net_core_2.1 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.2 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.4 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.6 | — | — |
| msrc | net_6.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target component is Kestrel (ASP.NET Core web server); monitor for slow-read or connection-stalling behavior from clients that are not being disconnected by Kestrel, which is the exploitation pattern for this DoS. ↗
- →No authentication or user privileges are required on the target system; any unauthenticated network-adjacent client can trigger the vulnerability, so anomalous unauthenticated connection floods to Kestrel-hosted services should be investigated. ↗
- →The vulnerability is actively exploited in the wild (confirmed by Microsoft); treat any unpatched .NET / ASP.NET Core Kestrel deployment as a high-priority detection target. ↗
- →If a reverse proxy or WAF with HTTP-based attack mitigations sits in front of the Kestrel server, the attack surface is reduced; absence of such controls in front of a Kestrel endpoint increases risk and should be flagged in asset inventory. ↗
- ·The vulnerability is specific to the Kestrel component of .NET; applications not using Kestrel as the HTTP server are not directly affected by this attack vector. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.8HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_ubuntu7.8HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens ST7 ScadaConnect
cisa_ics·2024-06-13·CVSS 7.5
[HIGH] Siemens ST7 ScadaConnect
ICS Advisory
##
Siemens ST7 ScadaConnect
Release DateJune 13, 2024
Alert CodeICSA-24-165-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: ST7 ScadaConnect
- Vulnerabilities: Integer Overflow or Wraparound, Double Free, Improper Certificate Validation, Inefficient Regular Ex
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2023-08-10·CVSS 7.8
CVE-2023-38180 [HIGH] .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in .NET.
USN-6278-1 fixed several vulnerabilities in .NET. This update
provides the corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that .NET did properly handle the execution of
certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)
Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)
It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of servi
CISA
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
cisa·2023-08-09·CVSS 7.5
CVE-2023-38180 [HIGH] Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Vulnerability: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Affected: Microsoft .NET Core and Visual Studio
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180; https://nvd.nist.gov/vuln/detail/CVE-2023-38180
Remediation Due Date: 2023-08-30
Red Hat
dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack
vendor_redhat·2023-08-08·CVSS 7.5
CVE-2023-38180 [HIGH] CWE-400 dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack
dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack
.NET and Visual Studio Denial of Service Vulnerability
An uncontrolled resource consumption vulnerability was found in the Kestrel component of the dotNET. When detecting a potentially malicious client, Kestrel will sometimes fail to disconnect it, resulting in denial of service.
Mitigation: If your application is running behind a reverse proxy, or Web Application Firewall, which has its own mitigations against HTTP based attacks this issue may be mitigated by the proxy or WAF.
Microsoft
.NET and Visual Studio Denial of Service Vulnerability
vendor_msrc·2023-08-08·CVSS 7.5
CVE-2023-38180 [HIGH] .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
ASP.NET: ASP.NET
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;DOS:N/A
Remediation: Release Notes
Reference: https://github.com/dotnet/announcements/issues/269
Reference: https://dotnet.microsoft.com/download/dotnet/6.0
Reference: https://support.microsoft.com/help/5029688
Reference: https://dotnet.microsoft.com/download/dotnet/7.0
Reference: https://support.microsoft.com/help/5029689
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.2
Reference: https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Reference: https://my.visualstudio.com/Downloa
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2023-08-08·CVSS 7.8
CVE-2023-38180 [HIGH] .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in .NET.
It was discovered that .NET did not properly handle the execution
of certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)
Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)
It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-38180)
Instructions: In general, a standard system update will make all the necessary changes.
OSV
dotnet6, dotnet7 vulnerabilities
osv·2023-08-10·CVSS 7.8
CVE-2023-35390 [HIGH] dotnet6, dotnet7 vulnerabilities
dotnet6, dotnet7 vulnerabilities
USN-6278-1 fixed several vulnerabilities in .NET. This update
provides the corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that .NET did properly handle the execution of
certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)
Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)
It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-38180)
GHSA
.NET Denial of Service Vulnerability
ghsa·2023-08-09·CVSS 7.5
CVE-2023-38180 [HIGH] CWE-400 .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
# Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A vulnerability exists in Kestrel where, on detecting a potentially malicious client, Kestrel will sometimes fail to disconnect it, resulting in denial of service.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/269
### Mitigation factors
If your application is running behind a reverse proxy, or Web Application Firewall, which has i
OSV
.NET Denial of Service Vulnerability
osv·2023-08-09·CVSS 7.5
CVE-2023-38180 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
# Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A vulnerability exists in Kestrel where, on detecting a potentially malicious client, Kestrel will sometimes fail to disconnect it, resulting in denial of service.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/269
### Mitigation factors
If your application is running behind a reverse proxy, or Web Application Firewall, which has i
OSV
CVE-2023-38180
osv·2023-08-08·CVSS 7.5
CVE-2023-38180 [HIGH] CVE-2023-38180
.NET and Visual Studio Denial of Service Vulnerability
VulnCheck
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
vulncheck·2023·CVSS 7.5
CVE-2023-38180 [HIGH] Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
Affected: Microsoft .NET Core and Visual Studio
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Aug; https://www.verizon.com/business/resources/T6c7/reports/2024-dbir-data-breach-investigations-report.pdf
Remediation Due: 2023-08-30
No detection rules found.
No public exploits indexed.
Sentinelone
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
blogs_sentinelone·2023-10-03
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
This week, Firefox users were urged to apply Mozilla’s latest updates against a critical flaw that could allow attackers to take control of affected systems. It follows hard on the heels of similar updates for Microsoft Edge, Google Chrome, and Apple’s Safari browser. All have been heavily impacted by an actively exploited vulnerability in the WebP code library.
Although the WebP vulnerability affects other software as well, browsers are by far and away the most ubiquitous and widely used applications on end user devices . Having a foothold in a compromised browser gives threat actors access to sensitive information and potential avenues into targeted environments.
In this post, we take a deep dive into browser security , exploring the differences between vulnerabilities and exploits, ze
Sentinelone
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
blogs_sentinelone·2023-10-03
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
This week, Firefox users were urged to apply Mozilla’s latest updates against a critical flaw that could allow attackers to take control of affected systems. It follows hard on the heels of similar updates for Microsoft Edge, Google Chrome, and Apple’s Safari browser. All have been heavily impacted by an actively exploited vulnerability in the WebP code library.
Although the WebP vulnerability affects other software as well, browsers are by far and away the most ubiquitous and widely used applications on end user devices. Having a foothold in a compromised browser gives threat actors access to sensitive information and potential avenues into targeted environments.
In this post, we take a deep dive into browser security, exploring the differences between vulnerabilities and exploits, zero
Krebs
Microsoft Patch Tuesday, August 2023 Edition
blogs_krebs·2023-08-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday, August 2023 Edition
Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including multiple zero-day vulnerabilities currently being exploited in the wild.
Six of the flaws fixed today earned Microsoft’s “critical” rating, meaning malware or miscreants could use them to install software on a vulnerable Windows system without any help from users.
Last month, Microsoft acknowledged a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in-the-wild attacks. They were assigned a single placeholder designation of CVE-2023-36884 .
Satnam Narang , senior staff research engineer at Tenable, said the August patch batch addresses CVE-2023-36884 , which involves bypassing the Windows
Krebs
Microsoft Patch Tuesday, August 2023 Edition
blogs_krebs·2023-08-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday, August 2023 Edition
Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including multiple zero-day vulnerabilities currently being exploited in the wild.
Six of the flaws fixed today earned Microsoft’s “critical” rating, meaning malware or miscreants could use them to install software on a vulnerable Windows system without any help from users.
Last month, Microsoft acknowledged a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in-the-wild attacks. They were assigned a single placeholder designation of CVE-2023-36884.
Satnam Narang, senior staff research engineer at Tenable, said the August patch batch addresses CVE-2023-36884, which involves bypassing the Windows Se
Talos
Six critical vulnerabilities included in August’s Microsoft security update
blogs_talos·2023-08-08·CVSS 8.8
[HIGH] Six critical vulnerabilities included in August’s Microsoft security update
Microsoft disclosed 73 vulnerabilities across its suite of products and software Tuesday, including six that are considered “critical.”
One of the vulnerabilities, which Microsoft considers to be only of "moderate" severity, has been actively exploited in the wild. The company has had to address many zero-day vulnerabilities in its monthly security updates this year, including four last month and one in May. Microsoft also released an advisory detailing changes to its defense-in-depth model to defend against tactics adversaries are currently using in the wild.
Outside of the six critical issues, two are considered to be of “moderate” severity, while the remainder are listed as “important.”
Two of the critical vulnerabilities lie in Microsoft Teams, the company’s popular collaboration an
Talos
Six critical vulnerabilities included in August’s Microsoft security update
blogs_talos·2023-08-08·CVSS 8.8
[HIGH] Six critical vulnerabilities included in August’s Microsoft security update
## Six critical vulnerabilities included in August’s Microsoft security update
Microsoft disclosed 73 vulnerabilities across its suite of products and software Tuesday, including six that are considered “critical.”
One of the vulnerabilities, which Microsoft considers to be only of "moderate" severity, has been actively exploited in the wild. The company has had to address many zero-day vulnerabilities in its monthly security updates this year, including four last month and one in May . Microsoft also released an advisory detailing changes to its defense-in-depth model to defend against tactics adversaries are currently using in the wild.
Outside of the six critical issues, two are considered to be of “moderate” severity, while the remainder are listed as “important.”
Two of the critic
Qualys
Microsoft and Adobe Patch Tuesday, August 2023 Security Update Review
blogs_qualys·2023-08-08
Microsoft and Adobe Patch Tuesday, August 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for August 2023
Adobe Patches for August 2023
Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft has released its August edition of Patch Tuesday. This month’s updates have addressed 89 security vulnerabilities in multiple products, features, and roles.
## Microsof
Tenable
Microsoft’s August 2023 Patch Tuesday Addresses 73 CVEs (CVE-2023-38180)
blogs_tenable·2023-08-08·CVSS 7.5
[HIGH] Microsoft’s August 2023 Patch Tuesday Addresses 73 CVEs (CVE-2023-38180)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft Patch Tuesday & Adobe August 2023 Security Fixes | Qualys
blogs_qualys·2023-08-08
Microsoft Patch Tuesday & Adobe August 2023 Security Fixes | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for August 2023
- Adobe Patches for August 2023
- Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft has released its August edition of Patch Tuesday. This month’s updates have addressed 89 security vulnerabilities in multiple products, features, and roles
Crowdstrike
August 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] August 2023 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180https://lists.fedoraproject.org/archives/list/[email protected]/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/https://lists.fedoraproject.org/archives/list/[email protected]/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180
2023-08-08
Published
2023-08-09
Added to CISA KEV
Exploited in the wild