CVE-2024-21392 json
.NET and Visual Studio Denial of Service Vulnerability
published 2024-03-12 2 y ago modified 2026-09-08 2 mo ago also BIT-dotnet-2024-21392 , BIT-dotnet-sdk-2024-21392 , BIT-powershell-2024-21392 , EUVD-2024-0828 , GHSA-5fxj-whcv-crrc
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
.NET and Visual Studio Denial of Service Vulnerability
Patch / fix
- nuget Microsoft.NETCore.App.Runtime.linux-arm 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-arm64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-musl-arm 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-musl-arm64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-musl-x64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-x64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.osx-arm64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.osx-x64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.win-arm 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.win-arm64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.win-x64 7.0.17, 8.0.3
- nuget Microsoft.NETCore.App.Runtime.win-x86 7.0.17, 8.0.3
- bitnami dotnet 7.0.17, 8.0.3
- bitnami dotnet-sdk 7.0.17, 8.0.3
- bitnami powershell 7.3.12
- Microsoft Microsoft Visual Studio 2022 version 17.9 17.9.3
- Microsoft PowerShell 7.3 7.3.12
- Microsoft PowerShell 7.4 7.4.1
- Microsoft .NET 7.0 7.0.17
- Microsoft .NET 8.0 8.0.3
- Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.13
- Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.17
- Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.8
- dotnet7 Ubuntu 22.04 LTS 7.0.117-0ubuntu1~22.04.1
- dotnet8 Ubuntu 22.04 LTS 8.0.103-8.0.3-0ubuntu1~22.04.1
ubuntu advisories UBUNTU-CVE-2024-21392
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- dotnet RHEL 8 8.0.103-1.el8_9
- dotnet8.0 RHEL 8 8.0.103-1.el8_9
- dotnet-host RHEL 8 8.0.3-1.el8_9
- dotnet-sdk-8.0 RHEL 8 8.0.103-1.el8_9
- dotnet-hostfxr-8.0 RHEL 8 8.0.3-1.el8_9
- dotnet-runtime-8.0 RHEL 8 8.0.3-1.el8_9
- dotnet-sdk-dbg-8.0 RHEL 8 8.0.103-1.el8_9
- dotnet-templates-8.0 RHEL 8 8.0.103-1.el8_9
red hat advisories RHSA-2024:1311RHSA-2024:1308RHSA-2024:1310RHSA-2024:1309
- dotnet-sdk-7.0 AlmaLinux 8 7.0.117-1.el8_9
- dotnet-hostfxr-7.0 AlmaLinux 8 7.0.17-1.el8_9
- dotnet-runtime-7.0 AlmaLinux 8 7.0.17-1.el8_9
- dotnet-templates-7.0 AlmaLinux 8 7.0.117-1.el8_9
- aspnetcore-runtime-7.0 AlmaLinux 8 7.0.17-1.el8_9
- dotnet-apphost-pack-7.0 AlmaLinux 8 7.0.17-1.el8_9
- dotnet-targeting-pack-7.0 AlmaLinux 8 7.0.17-1.el8_9
- aspnetcore-targeting-pack-7.0 AlmaLinux 8 7.0.17-1.el8_9
almalinux advisories ALSA-2024:1308ALSA-2024:1309ALSA-2024:1310ALSA-2024:1311
- dotnet7.0 Rocky Linux 8 7.0.117-1.el8_9
- dotnet8.0 Rocky Linux 8 8.0.103-1.el8_9
rocky linux advisories RLSA-2024:1308RLSA-2024:1311
- dotnet7-build Alpine 3.19 7.0.117-r0
- dotnet7-runtime Alpine 3.19 7.0.17-r0
- dotnet8-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 8.0.3-r0
alpine advisories ALPINE-CVE-2024-21392
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-21392 updated cvss 7.5
dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support
-
Red Hat CodeReady Linux Builder (v. 8) dotnet-sdk-7.0-source-built-artifacts 7.0.117-1.el8_9, dotnet-sdk-8.0-source-built-artifacts 8.0.103-1.el8_9fixed: vendor fix RHSA-2024:1308
-
Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-7.0-source-built-artifacts 7.0.117-1.el9_3, dotnet-sdk-8.0-source-built-artifacts 8.0.103-2.el9_3fixed: vendor fix RHSA-2024:1309
-
Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.103-1.el8_9, dotnet-host 8.0.3-1.el8_9, dotnet7.0 7.0.117-1.el8_9, dotnet8.0 8.0.103-1.el8_9, dotnet-sdk-7.0 7.0.117-1.el8_9, dotnet-sdk-8.0 8.0.103-1.el8_9, +18 morefixed: vendor fix RHSA-2024:1308
-
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.3-2.el9_3, dotnet7.0 7.0.117-1.el9_3, dotnet8.0 8.0.103-2.el9_3, dotnet-sdk-7.0 7.0.117-1.el9_3, dotnet-sdk-8.0 8.0.103-2.el9_3, dotnet-hostfxr-8.0 8.0.3-2.el9_3, +17 morefixed: vendor fix RHSA-2024:1309
-
Red Hat .NET 6.0 on Red Hat Enterprise Linux rh-dotnet60-dotnet, rh-dotnet60-dotnet-host, rh-dotnet60-dotnet-sdk-6.0, rh-dotnet60-dotnet-hostfxr-6.0, rh-dotnet60-dotnet-runtime-6.0, rh-dotnet60-dotnet-templates-6.0, +6 more Red Hat Enterprise Linux 8 dotnet, dotnet6.0, dotnet-host, dotnet-sdk-6.0, dotnet-hostfxr-6.0, dotnet-runtime-6.0, +7 more Red Hat Enterprise Linux 9 dotnet6.0, dotnet-host, dotnet-sdk-6.0, dotnet-hostfxr-6.0, dotnet-runtime-6.0, dotnet-templates-6.0, +6 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
3.09% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App.Runtime.linux-arm | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm64 | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >=8.0.0, <8.0.3 >=7.0.0-preview.1.22076.8, <7.0.17 |
8.0.3 7.0.17 |
| nuget | Microsoft.NETCore.App.Runtime.osx-arm64 | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.osx-x64 | >=8.0.0, <8.0.3 >=7.0.0-preview.1.22076.8, <7.0.17 |
8.0.3 7.0.17 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm64 | >=7.0.0-preview.1.22076.8, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.win-x64 | >=8.0.0, <8.0.3 >=7.0.0-preview.1.22076.8, <7.0.17 |
8.0.3 7.0.17 |
| nuget | Microsoft.NETCore.App.Runtime.win-x86 | >=8.0.0, <8.0.3 >=7.0.0-preview.1.22076.8, <7.0.17 |
8.0.3 7.0.17 |
| bitnami | dotnet | >=7.0.0, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| bitnami | dotnet-sdk | >=7.0.0, <7.0.17 >=8.0.0, <8.0.3 |
7.0.17 8.0.3 |
| bitnami | powershell | >=7.3.0, <7.3.12 |
7.3.12 |
Affected products
- Microsoft Microsoft Visual Studio 2022 version 17.9
- Microsoft PowerShell 7.3
- Microsoft PowerShell 7.4
- Microsoft .NET 7.0
- Microsoft .NET 8.0
- Microsoft Microsoft Visual Studio 2022 version 17.6
- Microsoft Microsoft Visual Studio 2022 version 17.4
- Microsoft Microsoft Visual Studio 2022 version 17.8
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
msrc.microsoft.com
/update-guide/vulnerability/CVE-2024-21392
vendor-advisory, web, patch, advisory
-
github.com
/dotnet/runtime/commit/5a958edb63110d8090c92fd34e2ae6379b23f4db
web
-
github.com
/dotnet/runtime/commit/e597140113b0bcfb47f80bc2a03c17a98fac14f3
web
-
github.com
/dotnet/runtime/security/advisories/GHSA-5fxj-whcv-crrc
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-21392
advisory, web
-
github.com
/dotnet/announcements/issues/299
web
-
github.com
/dotnet/runtime/issues/99621
web
-
github.com
/dotnet/runtime
package
Sources
- CVE List CVE-2024-21392
- GitHub Advisory GHSA-5fxj-whcv-crrc
- NVD CVE-2024-21392
- OSV BIT-dotnet-2024-21392
- OSV BIT-dotnet-sdk-2024-21392
- OSV BIT-powershell-2024-21392
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.