CVE-2018-8409

Vulnerability

A denial of service vulnerability exists in System.IO.Pipelines when it improperly handles requests. This affects .NET Core 2.1, System.IO.Pipelines, and ASP.NET Core 2.1. The vulnerable versions are Microsoft.AspNetCore.All >= 2.1.0, <= 2.1.3, Microsoft.AspNetCore.App >= 2.1.0, <= 2.1.3, and System.IO.Pipelines (NuGet) [1][2].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted requests to an application that uses the affected System.IO.Pipelines library. No authentication is required, and the attack can be performed remotely without user interaction [1].

Impact

Successful exploitation results in a denial of service condition, causing the application to become unresponsive or crash. The vulnerability does not allow code execution or privilege escalation; it only impacts availability [1][2].

Mitigation

Microsoft released updates in October 2018 that address this vulnerability. Users should upgrade to Microsoft.AspNetCore.All 2.1.4 or later, Microsoft.AspNetCore.App 2.1.4 or later, and System.IO.Pipelines 4.5.2 or later. No workarounds are documented [2]. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.