VYPR
← All advisories
High severityNVD Advisory· Published Jun 14, 2023· Updated Feb 28, 2025

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVE-2023-29331

Description

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial-of-service vulnerability in .NET and .NET Framework when importing specially crafted X.509 certificates, potentially leading to application crashes.

Vulnerability

Description

CVE-2023-29331 is a denial-of-service (DoS) vulnerability in .NET, .NET Framework, and Visual Studio caused by improper handling of X.509 certificate imports. When .NET processes a malicious binary certificate blob, the runtime may enter an infinite loop or consume excessive resources, resulting in an unresponsive application [1][4]. The root cause lies in how the runtime validates and imports certificate blobs; prior to the June 2023 security update, .NET delegated most validation to the operating system, but the updated code can fail under specific conditions [1].

Attack

Vector

An attacker can exploit this vulnerability by providing a specially crafted X.509 certificate to an affected .NET application through any input channel that accepts certificate data (e.g., file upload, network stream, or configuration). No authentication is required, and the attack does not need special privileges beyond the ability to submit data to a vulnerable endpoint. Applications using affected APIs such as new X509Certificate(byte[]) or X509Certificate2.Import(byte[]) are directly exposed [2][3]. Microsoft notes no mitigating factors exist for this vulnerability [2][3].

Impact

Successful exploitation causes the target application to become unresponsive or crash, leading to a denial of service. The vulnerability does not allow code execution or privilege escalation; its sole impact is on application availability. All supported versions of .NET 6.0 (prior to 6.0.16) and .NET 7.0 (prior to 7.0.5), as well as affected .NET Framework versions (2.0, 4.6.2–4.8, 4.8.1), are vulnerable [1][4].

Mitigation

Microsoft released security updates on June 13, 2023, that fix the certificate import logic. Users should update .NET 6.0 to 6.0.16 or later, .NET 7.0 to 7.0.5 or later, and apply the relevant .NET Framework patches (KB5025823) [1][2]. Workarounds include temporarily disabling certificate import APIs or using alternative validation routines, but updating is the only complete fix [1].

References
  1. KB5025823 Change in how .NET applications import X.509 certificates
  2. Microsoft Security Advisory CVE-2023-29331: .NET Denial of Service vulnerability
  3. Microsoft Security Advisory CVE-2023-29331: .NET Denial of Service vulnerability
  4. NVD - CVE-2023-29331

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.Windows.CompatibilityNuGet
>= 7.0.0, < 7.0.37.0.3
Microsoft.Windows.CompatibilityNuGet
>= 6.0.0, < 6.0.66.0.6
System.Security.Cryptography.PkcsNuGet
>= 7.0.0, < 7.0.27.0.2
System.Security.Cryptography.PkcsNuGet
>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 6.0.0, < 6.0.186.0.18

Affected products

57

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.