-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 3.0.0, < 3.1.25 | 3.1.25 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 5.0.0, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 5.0.1, < 5.0.17 | 5.0.17 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 6.0.0, < 6.0.5 | 6.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability (CWE-400) stems from uncontrolled memory allocations via HttpClient. The provided advisory and CVE details indicate that malicious clients exploit this by triggering excessive memory usage. Key functions involved in reading HTTP content (e.g., ReadAsByteArrayAsync) or managing request/response cycles (e.g., SendAsync in SocketsHttpHandler) are prime candidates. These functions directly handle input that, without proper size validation, lead to resource exhaustion. The confidence is 'medium' due to the lack of explicit patch code, but the functions align with the described vulnerability mechanism and .NET's HTTP stack design.