VYPR
← All advisories
High severityNVD Advisory· Published Sep 13, 2022· Updated Mar 11, 2025

.NET Core and Visual Studio Denial of Service Vulnerability

CVE-2022-38013

Description

.NET Core and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial of service vulnerability in ASP.NET Core's model binding can cause a stack overflow via crafted payloads.

Vulnerability

Overview

CVE-2022-38013 is a denial of service vulnerability in ASP.NET Core, affecting applications built on .NET 6.0 (up to 6.0.8) and .NET Core 3.1 (up to 3.1.28). The root cause lies in the model binding component, which parses incoming HTTP request data. A specially crafted payload can trigger an uncontrolled stack overflow, leading to a process crash and service unavailability [2].

Attack

Vector

An attacker can exploit this vulnerability by sending a malicious HTTP request to an affected ASP.NET Core application. No authentication is required; the attacker only needs network access to the vulnerable endpoint. The payload is designed to cause excessive recursion or deep parsing during model binding, ultimately exhausting the call stack and causing the application to terminate [2].

Impact

Successful exploitation results in a denial of service condition. The affected application becomes unresponsive or crashes, disrupting service for legitimate users. This can be especially impactful for internet-facing web applications where availability is critical. The vulnerability does not allow code execution or data exfiltration, but it can be used to repeatedly take services offline [2].

Mitigation

Microsoft has released patches for the affected versions: .NET 6.0.9 and .NET Core 3.1.29. Developers should update their applications to the latest runtime or SDK versions. For .NET 6, the patched version is 6.0.9; for .NET Core 3.1, the patched version is 3.1.29. The advisory provides specific package versions that need updating [2]. Fedora package announcements also reference this CVE [3][4].

References
  1. .NET Denial of Service Vulnerability
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.AspNetCore.App.Runtime.linux-armNuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.win-armNuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.win-x64NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.win-x86NuGet
>= 3.1.0, < 3.1.293.1.29
Microsoft.AspNetCore.App.Runtime.linux-armNuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-armNuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.osx-arm64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.win-armNuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.win-x64NuGet
>= 5.0.0, < 6.0.96.0.9
Microsoft.AspNetCore.App.Runtime.win-x86NuGet
>= 5.0.0, < 6.0.96.0.9

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

15

News mentions

0

No linked articles in our index yet.