-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled recursion during model binding. The ComplexTypeModelBinder's BindModelAsync method is responsible for recursively binding properties of complex models. In unpatched versions, it lacked proper recursion depth checks, allowing malicious payloads with excessive nesting to trigger stack overflows. This aligns with the advisory's description of 'customized payload parsed during model binding' causing DoS. The fix likely involved adding recursion depth tracking/limiting in this binder.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 5.0.0, < 6.0.9 | 6.0.9 |