medium 5.9

CVE-2024-30046 json

Visual Studio Denial of Service Vulnerability

published 2024-05-14 2 y ago modified 2026-09-08 2 mo ago also BIT-dotnet-2024-30046 , BIT-dotnet-sdk-2024-30046 , EUVD-2024-1648 , GHSA-hhc7-x9w4-cw47

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

Patch / fix

fixed in 20 distros 5

nuget Microsoft.AspNetCore.App.Runtime.linux-arm 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.osx-arm64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-arm 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-x64 7.0.19, 8.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-x86 7.0.19, 8.0.5
bitnami dotnet 7.0.19, 8.0.5
bitnami dotnet-sdk 7.0.19, 8.0.5
Microsoft .NET 7.0 7.0.19
Microsoft .NET 8.0 8.0.5
Microsoft Microsoft Visual Studio 2022 version 17.9 17.9.7
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.19
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.15
Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.10

ubuntu red hat almalinux rocky linux alpine

dotnet7 Ubuntu 22.04 LTS 7.0.119-0ubuntu1~22.04.1
dotnet8 Ubuntu 22.04 LTS 8.0.105-8.0.5-0ubuntu1~22.04.1
dotnet8 Ubuntu 24.04 LTS 8.0.105-8.0.5-0ubuntu1~24.04.1

ubuntu advisories UBUNTU-CVE-2024-30046

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

dotnet7.0 RHEL 8 7.0.119-1.el8_10
dotnet-sdk-7.0 RHEL 8 7.0.119-1.el8_10
dotnet-hostfxr-7.0 RHEL 8 7.0.19-1.el8_10
dotnet-runtime-7.0 RHEL 8 7.0.19-1.el8_10
dotnet-templates-7.0 RHEL 8 7.0.119-1.el8_10
aspnetcore-runtime-7.0 RHEL 8 7.0.19-1.el8_10
dotnet-apphost-pack-7.0 RHEL 8 7.0.19-1.el8_10
dotnet-targeting-pack-7.0 RHEL 8 7.0.19-1.el8_10

red hat advisories RHSA-2024:3340 RHSA-2024:3345 RHSA-2024:2843 RHSA-2024:2842

dotnet-sdk-7.0 AlmaLinux 8 7.0.119-1.el8_10
dotnet-hostfxr-7.0 AlmaLinux 8 7.0.19-1.el8_10
dotnet-runtime-7.0 AlmaLinux 8 7.0.19-1.el8_10
dotnet-templates-7.0 AlmaLinux 8 7.0.119-1.el8_10
aspnetcore-runtime-7.0 AlmaLinux 8 7.0.19-1.el8_10
dotnet-apphost-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10
dotnet-targeting-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10
aspnetcore-targeting-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10

almalinux advisories ALSA-2024:3340 ALSA-2024:3345 ALSA-2024:2843 ALSA-2024:2842

dotnet8.0 Rocky Linux 9 8.0.105-1.el9_4
dotnet7.0 Rocky Linux 9 7.0.119-1.el9_4
dotnet7.0 Rocky Linux 8 7.0.119-1.el8_10
dotnet8.0 Rocky Linux 8 8.0.105-1.el8_10

rocky linux advisories RLSA-2024:2842 RLSA-2024:2843 RLSA-2024:3340 RLSA-2024:3345

dotnet7-runtime Alpine 3.19 7.0.19-r0
dotnet8-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 8.0.5-r0

alpine advisories ALPINE-CVE-2024-30046

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-30046 updated 2026-11-05 cvss 5.9

dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop()

Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.105-1.el8_10, dotnet-host 8.0.5-1.el8_10, dotnet7.0 7.0.119-1.el8_10, dotnet8.0 8.0.105-1.el8_10, dotnet-sdk-7.0 7.0.119-1.el8_10, dotnet-sdk-8.0 8.0.105-1.el8_10, +18 more
fixed: vendor fix RHSA-2024:3340
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.5-1.el9_4, dotnet7.0 7.0.119-1.el9_4, dotnet8.0 8.0.105-1.el9_4, dotnet-sdk-7.0 7.0.119-1.el9_4, dotnet-sdk-8.0 8.0.105-1.el9_4, dotnet-hostfxr-8.0 8.0.5-1.el9_4, +17 more
fixed: vendor fix RHSA-2024:2843
Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-7.0-source-built-artifacts 7.0.119-1.el8_10, dotnet-sdk-8.0-source-built-artifacts 8.0.105-1.el8_10
fixed: vendor fix RHSA-2024:3340
Red Hat Enterprise Linux CRB (v. 9) dotnet-sdk-7.0-source-built-artifacts 7.0.119-1.el9_4, dotnet-sdk-8.0-source-built-artifacts 8.0.105-1.el9_4
fixed: vendor fix RHSA-2024:2843
Red Hat Enterprise Linux 10 dotnet8.0
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-05-15)

Exploit prediction

1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
GitHub	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	Microsoft.AspNetCore.App.Runtime.linux-arm	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.linux-arm64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>=8.0.0, <8.0.5 >=7.0.0, <7.0.19	8.0.5 7.0.19
nuget	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.linux-x64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.osx-arm64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.osx-x64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.win-arm	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.win-arm64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.win-x64	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
nuget	Microsoft.AspNetCore.App.Runtime.win-x86	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
bitnami	dotnet	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5
bitnami	dotnet-sdk	>=7.0.0, <7.0.19 >=8.0.0, <8.0.5	7.0.19 8.0.5

Affected products

Microsoft .NET 7.0
Microsoft .NET 8.0
Microsoft Microsoft Visual Studio 2022 version 17.9
Microsoft Microsoft Visual Studio 2022 version 17.4
Microsoft Microsoft Visual Studio 2022 version 17.6
Microsoft Microsoft Visual Studio 2022 version 17.8

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2024-30046
vendor-advisory, web, advisory
github.com /dotnet/aspnetcore/security/advisories/GHSA-hhc7-x9w4-cw47
web
nvd.nist.gov /vuln/detail/CVE-2024-30046
advisory, web
github.com /dotnet/announcements/issues/308
web
github.com /dotnet/aspnetcore/issues/55714
web
github.com /dotnet/aspnetcore
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary