CVE-2021-1723: ASP.NET Core and Visual Studio Denial of Service Vulnerability

Published Jan 12, 2021
·
Updated

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.

Other sources

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Affected Software

32 affected componentsFixes available
nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm=5.0.1
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.win-x86>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.win-x86>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.win-x64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.win-x64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.win-arm64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.win-arm64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.win-arm>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.win-arm>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.osx-x64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.osx-x64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.linux-x64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.linux-x64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.App.Runtime.linux-arm>=5.0.0<5.0.2
5.0.2
nuget/Microsoft.AspNetCore.App.Runtime.linux-arm>=3.1.0<3.1.11
3.1.11
nuget/Microsoft.AspNetCore.Server.Kestrel.Core<2.1.25
2.1.25
Microsoft Visual Studio 2019 (includes 16.0 – 16.6)=16.7
Patch available
Microsoft Visual Studio 2019 (includes 16.0 - 16.3)=16.4
Patch available
Microsoft Visual Studio 2019=16.8
Patch available
Microsoft ASP.NET Core=5.0
Patch available
Microsoft ASP.NET Core=3.1
Patch available
Microsoft ASP.NET Core>=3.1<=3.1.10
Microsoft ASP.NET Core>=5.0<=5.0.1
Microsoft Visual Studio 2019>=16.0<=16.8
Fedoraproject Fedora=32
Fedoraproject Fedora=33

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723

Event History

Jan 12, 2021
CVE Published
via Microsoft·08:00 AM
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
CVE Published
via MITRE·07:42 PM
Data Sourced
via MITRE·07:42 PM
DescriptionSeverity
May 24, 2022
Advisory Published
via GitHub·05:38 PM

Frequently Asked Questions

1

What is CVE-2021-1723?

CVE-2021-1723 is a Denial of Service vulnerability in ASP.NET Core and Visual Studio.

2

What is the severity of CVE-2021-1723?

CVE-2021-1723 has a severity of 7.5 (high).

3

Which software products are affected by CVE-2021-1723?

ASP.NET Core versions 3.1 to 3.1.10, 5.0 to 5.0.1, and Microsoft Visual Studio 2019 versions 16.0 to 16.8 are affected.

4

How can I fix CVE-2021-1723?

Apply the necessary updates or patches provided by Microsoft or Fedora Project, depending on the affected software.

5

Where can I find more information about CVE-2021-1723?

You can find more information about CVE-2021-1723 at the following reference: [link](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203