CVE-2021-1723: ASP.NET Core and Visual Studio Denial of Service Vulnerability
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.87023%
CWE
-
Published
5/24/2022
Updated
10/9/2024
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.AspNetCore.Server.Kestrel.Core | nuget | < 2.1.25 | 2.1.25 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 3.1.0, < 3.1.11 | 3.1.11 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 5.0.0, < 5.0.2 | 5.0.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | = 5.0.1 | 5.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from HTTP/2 request parsing in Kestrel. The affected component (Microsoft.AspNetCore.Server.Kestrel.Core) and the nature of the fix (parsing corrections) strongly implicate core HTTP/2 processing logic. The Http2Connection.ProcessHeadersFrameAsync and Http2HeadersDecoder.Decode are central to handling HTTP/2 headers and HPACK compression, common attack vectors for parsing-related DoS. While exact patch details are unavailable, these functions align with the vulnerability's description and Kestrel's HTTP/2 architecture.