Deadlock

Overview Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process. An attacker can cause the server to become unresponsive and exhaust system resources by sending crafted HTTP/3 reset or abort sequences that trigger excessive blocked-thread creation...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the HTTP/1 connection handling process. An attacker can gain unauthorized access to sensitive information or perform actions with elevated privileges by exploiting the ability to reparse unread request-body...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request processing when newline characters in request trailers and values from the dynamic HPACK table are accepted instead of being treated as malformed. An attacker can bypass security controls and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the request-localization process. An attacker can cause unbounded memory growth and disrupt service availability by sending unauthenticated requests with synthetic culture names...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the AuthorizeRouteView process. An attacker can gain unauthorized access to resources or perform actions with elevated privileges by exploiting a stale asynchronous authorization result that is incorrectly applied aft...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeReader process. An attacker can exhaust CPU resources by sending incrementally arriving form data that causes repeated rescanning of the buffered body, leading to significant performanc...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the FileBufferingReadStream process. An attacker can cause memory exhaustion and disrupt service availability by sending specially crafted multipart requests that trigger excessiv...

Weak Password Recovery Mechanism for Forgotten Password

Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the password reset and confirmation process. An attacker can gain unauthorized access to user accounts or intercept sensitive information by exploiting the ability to send...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SignalR service. An attacker can exhaust internal buffers and cause service disruption by sending malicious messages. Remediation Upgrade...