VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 9, 2024· Updated Jun 3, 2025

Microsoft Identity Denial of service vulnerability

CVE-2024-21319

Description

Microsoft Identity Denial of service vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial of service vulnerability in .NET ASP.NET Core templates and Microsoft.IdentityModel allows unauthenticated attackers to exhaust server memory via malicious JWT or JWE tokens.

A denial of service vulnerability exists in ASP.NET Core project templates that use JWT-based authentication tokens, as well as in the Microsoft.IdentityModel library. The issue arises from improper handling of JWT and JWE tokens, allowing an attacker to craft tokens that cause excessive memory allocation and processing time during decompression [1][2][4].

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted JWT or JWE token to a server using affected project templates. For JWE tokens, the attacker must have access to the public encryption key registered with the identity provider. The token triggers high memory consumption when the server attempts to decompress or validate it, leading to potential out-of-memory conditions [1][4].

Successful exploitation results in a denial of service, where the server can no longer respond to legitimate requests. The CVSS score indicates a scope change, meaning the impact extends beyond the token processing to affect overall system availability [4].

Microsoft has released patches for this vulnerability. Users should update Microsoft.IdentityModel packages to version 7.1.2, 6.34.0, or 5.7.0 or higher. For ASP.NET Core projects, update the Microsoft.AspNetCore.Authentication.JwtBearer, Microsoft.AspNetCore.Authentication.OpenIdConnect, and Microsoft.IdentityModel.JsonWebTokens packages to the latest versions [1][4].

References
  1. Microsoft Security Advisory CVE-2024-21319: .NET Denial of Service Vulnerability
  2. Microsoft Security Advisory CVE-2024-21319: .NET Denial of Service Vulnerability
  3. Microsoft Identity Denial of service vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.IdentityModel.Tokens.JwtNuGet
< 5.7.05.7.0
System.IdentityModel.Tokens.JwtNuGet
>= 6.5.0, < 6.34.06.34.0
System.IdentityModel.Tokens.JwtNuGet
>= 7.0.0-preview, < 7.1.27.1.2
Microsoft.IdentityModel.JsonWebTokensNuGet
< 5.7.05.7.0
Microsoft.IdentityModel.JsonWebTokensNuGet
>= 6.5.0, < 6.34.06.34.0
Microsoft.IdentityModel.JsonWebTokensNuGet
>= 7.0.0-preview, < 7.1.27.1.2

Affected products

65

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.