VYPR
← All advisories
High severityNVD Advisory· Published Jul 9, 2024· Updated Dec 9, 2025

.NET and Visual Studio Denial of Service Vulnerability

CVE-2024-30105

Description

.NET and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial of service vulnerability exists in .NET when deserializing untrusted input with System.Text.Json's JsonSerializer.DeserializeAsyncEnumerable method.

Vulnerability

Overview

CVE-2024-30105 is a denial of service (DoS) vulnerability in .NET 8.0, specifically within the System.Text.Json package. The flaw is triggered when calling the JsonSerializer.DeserializeAsyncEnumerable method against untrusted input, leading to excessive resource consumption and ultimately a denial of service [1]. The root cause lies in how the deserializer handles certain crafted payloads during asynchronous enumeration, causing unbounded memory or CPU usage.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted JSON input to a .NET application that uses the affected DeserializeAsyncEnumerable method. No authentication is required if the vulnerable endpoint is publicly accessible; the only prerequisite is that the application deserializes untrusted data using the affected API surface. The attack can be conducted over the network, making it remotely exploitable without any special privileges [2].

Impact

Successful exploitation leads to a denial of service condition, rendering the targeted .NET application unresponsive. The impact is limited to availability; there is no risk of data compromise or privilege escalation based on the advisory [1][2].

Mitigation

Microsoft has released a patched version of the affected package: System.Text.Json version 8.0.4 (for .NET 8.0). Developers should upgrade their applications to .NET 8.0.7 or later, which includes the fix. There are no known workarounds for this vulnerability [1].

References
  1. Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability
  2. NVD - CVE-2024-30105

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.Text.JsonNuGet
>= 7.0.0, < 8.0.48.0.4

Affected products

44

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.