Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8409: System.IO.Pipelines Denial of Service in .NET Core 2.1

CVE-2018-8409 · published 8 years ago

Summary

A bug in .NET Core 2.1 can cause a website or service to become unavailable if an attacker sends a specially crafted request. This affects websites and services built with .NET Core 2.1, so take steps to update your software to the latest version to prevent this from happening.

What to do

Update microsoft microsoft.aspnetcore.all to version 2.1.4.
Update microsoft system.io.pipelines to version 4.5.1.
Update microsoft microsoft.aspnetcore.app to version 2.1.4.
Update microsoft .net_core to version 2.1.4 or later.
Update microsoft asp.net_core to version 2.1.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
nuget	microsoft	microsoft.aspnetcore.all	>= 2.1.0, <= 2.1.3 Fix: upgrade to 2.1.4
nuget	microsoft	system.io.pipelines	4.5.0 Fix: upgrade to 4.5.1
–	microsoft	.net_core	>= 2.1, < 2.1.4 `cpe:2.3:a:microsoft:.net_core::::::::`
–	microsoft	asp.net_core	>= 2.1, < 2.1.4 `cpe:2.3:a:microsoft:asp.net_core::::::::`
–	microsoft	system.io.pipelines	4.5.0 `cpe:2.3:a:microsoft:system.io.pipelines:4.5.0:::::::*`
nuget	microsoft	microsoft.aspnetcore.app	>= 2.1.0, <= 2.1.3 Fix: upgrade to 2.1.4

Original advisory text

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET ...

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

7% chance of attack within 30 days

Timeline

Published13 Sep 2018

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-j378-6mmw-hqfr · GHSA

CVE-2018-8409 · NVD

Track software like this

Free during beta