Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Microsoft .NET Framework 4.6 and later versions can be crashed by a malicious request

CVE-2017-8585 · published 9 years ago
Summary

Some versions of Microsoft .NET Framework are vulnerable to a denial of service attack. An attacker could send a specially crafted request to a .NET web application, causing it to stop working. You should update to a secure version of .NET Framework to protect against this issue.

What to do
  • Update microsoft microsoft.netcore.app to version 1.0.7.
  • Update microsoft microsoft.netcore.app to version 1.1.4.
Affected software
Ecosystem VendorProductAffected versions
nuget microsoft microsoft.netcore.app >= 1.0.0, < 1.0.7
>= 1.1.0, < 1.1.4
Fix: upgrade to 1.0.7
– microsoft .net_framework 4.6
4.6.1
4.6.2
4.7
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
Original advisory text
Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulner...
Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
10% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published11 Jul 2017
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-8884-xcr4-r68p · GHSA
CVE-2017-8585 · NVD
Track software like this
Free during beta