VYPR
← All advisories
High severityNVD Advisory· Published Jul 9, 2024· Updated Dec 9, 2025

.NET and Visual Studio Denial of Service Vulnerability

CVE-2024-38095

Description

.NET and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-38095 is a denial-of-service vulnerability in .NET's X.509 certificate parsing (System.Formats.Asn1) affecting versions 6.0 and 8.0, patched in July 2024.

Vulnerability

Overview

CVE-2024-38095 is a denial-of-service vulnerability that exists when .NET's System.Formats.Asn1 component parses an X.509 certificate or collection of certificates [1]. A specially crafted malicious certificate can cause excessive CPU consumption on any platform, leading to a denial of service [1]. The vulnerability affects .NET 6.0 applications running version 6.0.31 or earlier, and .NET 8.0 applications running version 8.0.6 or earlier [1].

Exploitation

Conditions

The vulnerability is triggered when an application using the affected .NET runtime parses a malicious X.509 certificate [1]. No special authentication or network position is required, as the attacker only needs to provide a crafted certificate to a parsing endpoint. Microsoft has not identified any mitigating factors for this vulnerability [1].

Impact

Successful exploitation results in excessive CPU consumption, leading to a denial of service on the target system [1][2]. The vulnerability can be exploited on all supported platforms, and the CPU exhaustion can potentially impact the availability of the affected application or system [1].

Mitigation

Microsoft has released patches for the vulnerability [1]. .NET 6.0 should be updated to version 6.0.32 or later, and .NET 8.0 should be updated to version 8.0.7 or later [1]. The corresponding runtime packages (e.g., Microsoft.NetCore.App.Runtime.*) and the System.Formats.Asn1 package have been patched [1]. Users are advised to apply the updates through standard update channels. There are no workarounds available [1].

References
  1. Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability
  2. NVD - CVE-2024-38095

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.78.0.7
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 6.0.0, < 6.0.326.0.32
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.78.0.7
System.Formats.Asn1NuGet
>= 5.0.0-preview.7.20364.11, < 6.0.16.0.1
System.Formats.Asn1NuGet
>= 7.0.0-preview.1.22076.8, < 8.0.18.0.1

Affected products

69

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.