BIT-dotnet-2021-31957 — ASP.NET Core Denial of Service Vulnerability

Affected: Bitnami: dotnet

ASP.NET Core Denial of Service Vulnerability

certfr-2021-avi-449 — Une vulnérabilité a été corrigée dans Microsoft .Net. Elle permet à un attaquant de provoqu…

certfr-2021-avi-449

EUVD-2026-27770

fkie_cve-2021-31957

ASP.NET Core Denial of Service Vulnerability

Withdrawn: GHSA-mcwm-2wmc-6hv4 — ASP.NET Core Denial of Service Vulnerability

Withdrawn by the publisher.

Affected: NuGet: Microsoft.NETCore.App.Ref

# Withdrawn

This advisory was initially published and mapped incorrectly to nuget `Microsoft.NETCore.App.Ref`. We later reanalyzed this advisory and found it does not have a direct mapping to a NuGet package. Thus we have withdrawn this advisory.

The underlying ASP.NET Core Denial of Service Vulnerability and CVE-2021-31957 remain legitimate.

# Description.

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists when ASP.NET Core improperly handles client disconnect. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.

### Patches

* If you're using .NET 5.0, you should download and install Runtime 5.0.7 or SDK 5.0.204 (for Visual Studio 2019 v16.8) or SDK 5.0.301 (for Visual Studio 2019 16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.16 or SDK 3.1.116 (for Visual Studio 2019 v16.4) or 3.1.410 (for Visual Studio 2019 v16.5 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issu…

RHSA-2021:2350 — Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update

dotnet: ASP.NET Core Client Disconnect Denial of Service

RHSA-2021:2352 — Red Hat Security Advisory: .NET Core 3.1 security and bugfix update