Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.8 or earlier. * Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name="ASP.NET Core 3.1"></a>.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29 ### <a name=".NET 6"></a>.NET 6 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9 ### Other Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.8 or earlier. * Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name="ASP.NET Core 3.1"></a>.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29 ### <a name=".NET 6"></a>.NET 6 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9 ### Other Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
Update Microsoft.AspNetCore.App.Runtime.linux-arm to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.osx-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.osx-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.osx-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-arm to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-x86 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-x86 to 6.0.9 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan.NET Denial of Service Vulnerability affects Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-arm (nuget), Microsoft.AspNetCore.App.Runtime.win-arm (nuget), Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x86 (nuget), Microsoft.AspNetCore.App.Runtime.win-x86 (nuget). Severity is high. Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.8 or earlier. * Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name="ASP.NET Core 3.1"></a>.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29 ### <a name=".NET 6"></a>.NET 6 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9 ### Other Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
AI coding agents often install or upgrade packages automatically in nuget. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-armnuget | >=3.1.0,<3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate Microsoft.AspNetCore.App.Runtime.linux-arm to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.linux-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.linux-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.osx-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.osx-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.osx-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-arm to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-arm to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-arm64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-arm64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-x64 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-x64 to 6.0.9; Microsoft.AspNetCore.App.Runtime.win-x86 to 3.1.29; Microsoft.AspNetCore.App.Runtime.win-x86 to 6.0.9 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan.NET Denial of Service Vulnerability affects Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget), Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-arm (nuget), Microsoft.AspNetCore.App.Runtime.win-arm (nuget), Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x64 (nuget), Microsoft.AspNetCore.App.Runtime.win-x86 (nuget), Microsoft.AspNetCore.App.Runtime.win-x86 (nuget). Severity is high. Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.8 or earlier. * Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name="ASP.NET Core 3.1"></a>.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29 ### <a name=".NET 6"></a>.NET 6 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9 ### Other Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
AI coding agents often install or upgrade packages automatically in nuget. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-armnuget | >=3.1.0,<3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-armnuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x86nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x86nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.osx-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-armnuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-armnuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-arm64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-arm64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x64nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x64nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x86nuget | >=3.1.0,<3.1.29 | 3.1.29 |
|---|
| Microsoft.AspNetCore.App.Runtime.win-x86nuget | >=5.0.0,<6.0.9 | 6.0.9 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.