A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Co

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft .net core1.0
• microsoft .net core1.1
• microsoft .net core2.1
• microsoft .net core2.2
• microsoft .net framework2.0
• microsoft .net framework3.0
• microsoft .net framework3.5
• microsoft .net framework3.5.1
• microsoft .net framework4.5.2
• microsoft .net framework4.6
• microsoft .net framework4.6.1
• microsoft .net framework4.6.2
• microsoft .net framework4.7
• microsoft .net framework4.7.1
• microsoft .net framework4.7.2
• microsoft .net framework4.8
• redhat enterprise linux8.0
• redhat enterprise linux eus8.1
• redhat enterprise linux eus8.2
• redhat enterprise linux eus8.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft .NET Core

  • 1, 1.1, 2.1, 2.2affected

• Microsoft Microsoft .NET Framework 2.0

  • Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2affected

• Microsoft Microsoft .NET Framework 3.0

  • Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2affected

• Microsoft Microsoft .NET Framework 3.5

  • Windows Server 2012, Windows Server 2012 (Server Core installation), Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows Server 2016, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 (Server Core installation) … (+13)affected

• Microsoft Microsoft .NET Framework 3.5 on Windows 10 Version 1903 for 32-bit Systems

  • unspecifiedaffected

• Microsoft Microsoft .NET Framework 3.5 on Windows 10 Version 1903 for x64-based Systems

  • unspecifiedaffected

• Microsoft Microsoft .NET Framework 3.5 on Windows Server, version 1903 (Server Core installation)

  • unspecifiedaffected

• Microsoft Microsoft .NET Framework 3.5.1

  • Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1affected

• Microsoft Microsoft .NET Framework 4.5.2

  • Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012 R2 (Server Core installation), Windows Server 2008 for 32-bit Systems Service Pack 2 … (+1)affected

• Microsoft Microsoft .NET Framework 4.6

  • Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2affected

• Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

  • Windows Server 2016, Windows Server 2016 (Server Core installation)affected

• Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2

  • Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012 R2 (Server Core installation)affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-1147A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check theKEV
  89Now
• CVE-2018-0764Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0.
  33Monitor
• CVE-2019-1301A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.
  32Monitor
• CVE-2018-8409A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service."
  32Monitor
• CVE-2018-0765A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service
  32Monitor
• CVE-2019-0981A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.