Affected: AlmaLinux:8: aspnetcore-runtime-6.0, AlmaLinux:8: aspnetcore-targeting-pack-6.0, AlmaLinux:8: dotnet-apphost-pack-6.0, AlmaLinux:8: dotnet-hostfxr-6.0, AlmaLinux:8: dotnet-runtime-6.0, AlmaLinux:8: dotnet-sdk-6.0, AlmaLinux:8: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-6.0, AlmaLinux:8: dotnet-templates-6.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35.

Security Fix(es):

* dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

* dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:stream: dotnet6-runtime

Affected: Bitnami: dotnet

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-43483 affects multiple packages. . See references for individual vulnerability details.

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Affected: NuGet: System.Security.Cryptography.Cose, NuGet: System.IO.Packaging, NuGet: Microsoft.Extensions.Caching.Memory

# Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory may be exposed to a hostile input which may lead them to be susceptible to hash flooding attacks resulting in denial of service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/327

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 8.0 application running on .NET 8.0.8 or earlier. * Any .NET 6.0 aplication running on .NET 6.0.33 or earlier. * Any application consuming one of the [vulnerable packages](affected-packages).

## <a name="affected-packages"></a>Affected Packages * Any .NET 6.0, 8.0, or 9.0 application. * Any application consuming one of the vulnerable packages.

### <a name=".NET 9 "></a>.NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Crypto…

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability .NET Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability

dotnet: Multiple .NET components susceptible to hash flooding dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList dotnet: Denial of Service in System.Text.Json

dotnet: Multiple .NET components susceptible to hash flooding dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList dotnet: Denial of Service in System.Text.Json

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2015, Microsoft Visual Studio 2017, Microsoft Visual Studio Code, Microsoft .NET Framework, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022 und Microsoft Visual C++ ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen.