high 7.5

CVE-2024-30105 json

.NET and Visual Studio Denial of Service Vulnerability

published 2024-07-09 2 y ago modified 2026-09-10 1 mo ago also BIT-dotnet-2024-30105 , BIT-dotnet-sdk-2024-30105 , EUVD-2024-2362 , GHSA-hh2w-p6rv-4g7w

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.9%; EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Patch / fix

fixed in 9 distros 5 links 1

nuget System.Text.Json 8.0.4
bitnami dotnet 8.0.8
bitnami dotnet-sdk 8.0.8
Microsoft .NET 8.0 8.0.7
Microsoft PowerShell 7.4 7.4.4
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.21
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.17
Microsoft Microsoft Visual Studio 2022 version 17.10 17.10.4
Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.12

ubuntu red hat almalinux rocky linux alpine

dotnet8 Ubuntu 22.04 LTS 8.0.107-8.0.7-0ubuntu1~22.04.1
dotnet8 Ubuntu 24.04 LTS 8.0.107-8.0.7-0ubuntu1~24.04.1

ubuntu advisories UBUNTU-CVE-2024-30105

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

dotnet8.0 RHEL 9 8.0.107-1.el9_4
dotnet-host RHEL 9 8.0.7-1.el9_4
dotnet-sdk-8.0 RHEL 9 8.0.107-1.el9_4
dotnet-hostfxr-8.0 RHEL 9 8.0.7-1.el9_4
dotnet-runtime-8.0 RHEL 9 8.0.7-1.el9_4
dotnet-sdk-dbg-8.0 RHEL 9 8.0.107-1.el9_4
dotnet-templates-8.0 RHEL 9 8.0.107-1.el9_4
aspnetcore-runtime-8.0 RHEL 9 8.0.7-1.el9_4

red hat advisories RHSA-2024:4450 RHSA-2024:4451

dotnet-host AlmaLinux 9 8.0.7-1.el9_4
dotnet-sdk-8.0 AlmaLinux 9 8.0.107-1.el9_4
dotnet-hostfxr-8.0 AlmaLinux 9 8.0.7-1.el9_4
dotnet-runtime-8.0 AlmaLinux 9 8.0.7-1.el9_4
dotnet-sdk-dbg-8.0 AlmaLinux 9 8.0.107-1.el9_4
dotnet-templates-8.0 AlmaLinux 9 8.0.107-1.el9_4
aspnetcore-runtime-8.0 AlmaLinux 9 8.0.7-1.el9_4
dotnet-runtime-dbg-8.0 AlmaLinux 9 8.0.7-1.el9_4

almalinux advisories ALSA-2024:4450 ALSA-2024:4451

dotnet8.0 Rocky Linux 9 8.0.107-1.el9_4
dotnet8.0 Rocky Linux 8 8.0.107-1.el8_10

rocky linux advisories RLSA-2024:4450 RLSA-2024:4451

dotnet8-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 8.0.7-r0

alpine advisories ALPINE-CVE-2024-30105

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30105 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-30105 updated 2026-11-04 cvss 7.5

dotnet: DoS in System.Text.Json

Red Hat Enterprise Linux 9 dotnet7.0, dotnet-sdk-7.0, dotnet-hostfxr-7.0, dotnet-runtime-7.0, dotnet-templates-7.0, aspnetcore-runtime-7.0, +4 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.107-1.el8_10, dotnet-host 8.0.7-1.el8_10, dotnet8.0 8.0.107-1.el8_10, dotnet-sdk-8.0 8.0.107-1.el8_10, dotnet-hostfxr-8.0 8.0.7-1.el8_10, dotnet-runtime-8.0 8.0.7-1.el8_10, +9 more
fixed: vendor fix RHSA-2024:4451
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.7-1.el9_4, dotnet8.0 8.0.107-1.el9_4, dotnet-sdk-8.0 8.0.107-1.el9_4, dotnet-hostfxr-8.0 8.0.7-1.el9_4, dotnet-runtime-8.0 8.0.7-1.el9_4, dotnet-sdk-dbg-8.0 8.0.107-1.el9_4, +8 more
fixed: vendor fix RHSA-2024:4450
Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts 8.0.107-1.el8_10
fixed: vendor fix RHSA-2024:4451
Red Hat Enterprise Linux CRB (v. 9) dotnet-sdk-8.0-source-built-artifacts 8.0.107-1.el9_4
fixed: vendor fix RHSA-2024:4450
Red Hat .NET 6.0 on Red Hat Enterprise Linux rh-dotnet60-dotnet, rh-dotnet60-dotnet-host, rh-dotnet60-dotnet-sdk-6.0, rh-dotnet60-dotnet-hostfxr-6.0, rh-dotnet60-dotnet-runtime-6.0, rh-dotnet60-dotnet-templates-6.0, +6 more Red Hat Enterprise Linux 8 dotnet, dotnet6.0, dotnet-host, dotnet-sdk-6.0, dotnet-hostfxr-6.0, dotnet-runtime-6.0, +7 more Red Hat Enterprise Linux 9 dotnet6.0, dotnet-host, dotnet-sdk-6.0, dotnet-hostfxr-6.0, dotnet-runtime-6.0, dotnet-templates-6.0, +6 more Red Hat Enterprise Linux 10 dotnet8.0
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-135-02 updated 2025-05-13 cvss 7.5

Siemens INTRALOG WMS

Siemens INTRALOG WMS < V5
affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-100-02 updated 2025-05-06 cvss 7.5

Siemens SIDIS Prime

Siemens SIDIS Prime <V4.0.700
affected: fixed in V4.0.700

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-07-10)

Exploit prediction

2.94% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	System.Text.Json	>=7.0.0, <8.0.4	8.0.4
bitnami	dotnet	>=8.0.0, <8.0.8	8.0.8
bitnami	dotnet-sdk	>=8.0.0, <8.0.8	8.0.8

Affected products

Microsoft .NET 8.0
Microsoft PowerShell 7.4
Microsoft Microsoft Visual Studio 2022 version 17.4
Microsoft Microsoft Visual Studio 2022 version 17.6
Microsoft Microsoft Visual Studio 2022 version 17.10
Microsoft Microsoft Visual Studio 2022 version 17.8

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2024-30105
vendor-advisory, web, patch, advisory
github.com /dotnet/runtime/security/advisories/GHSA-hh2w-p6rv-4g7w
web
nvd.nist.gov /vuln/detail/CVE-2024-30105
advisory, web
github.com /dotnet/runtime
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary