VYPR
← All advisories
High severityNVD Advisory· Published Oct 8, 2024· Updated Jul 8, 2025

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVE-2024-43483

Description

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

.NET, .NET Framework, and Visual Studio are vulnerable to a denial of service via hash flooding in System.Security.Cryptography.Cose, System.IO.Packaging, and Microsoft.Extensions.Caching.Memory.

Vulnerability

Overview

CVE-2024-43483 is a denial of service vulnerability affecting .NET, .NET Framework, and Visual Studio. The root cause lies in three specific libraries: System.Security.Cryptography.Cose, System.IO.Packaging, and Microsoft.Extensions.Caching.Memory [2]. These components are susceptible to hash flooding attacks, a class of algorithmic complexity attack that can cause excessive CPU consumption when processing hostile input [2].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by sending specially crafted input to an application that uses any of the affected libraries [2]. The attack does not require authentication or special privileges; it is network-based and can be triggered remotely. The vulnerable packages are used in various .NET application types, including web services, desktop applications, and cloud-native workloads [2][3]. The affected versions span .NET 6, 8, and 9 preview releases, as well as the final releases of .NET 6.0 and 8.0 [2].

Impact

Successful exploitation results in a denial of service condition. The targeted application or service may become unresponsive or crash due to resource exhaustion from the hash flooding attack [2]. This can lead to service disruption for legitimate users, potentially impacting availability in production environments [2].

Mitigation

Status

Microsoft has released patched versions of all affected packages to address this vulnerability [2]. Developers should update to the following minimum versions: .NET 8.0.1, .NET 6.0.2 for System.IO.Packaging and Microsoft.Extensions.Caching.Memory (.NET 6.0.1 for System.Security.Cryptography.Cose is not listed, but .NET 6.0.33 SDK includes the fix), and .NET 9.0-rc.2 for preview users [2]. No mitigating factors have been identified [2].

References
  1. Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability
  2. GitHub - dotnet/runtime: .NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.Security.Cryptography.CoseNuGet
>= 9.0.0-preview.1.24080.9, < 9.0.0-rc.2.24473.59.0.0-rc.2.24473.5
System.IO.PackagingNuGet
>= 9.0.0-preview.1.24080.9, < 9.0.0-rc.2.24473.59.0.0-rc.2.24473.5
System.Security.Cryptography.CoseNuGet
>= 8.0.0-preview.1.23110.8, < 8.0.18.0.1
System.IO.PackagingNuGet
>= 6.0.0-preview.1.21102.12, < 6.0.16.0.1
System.IO.PackagingNuGet
>= 8.0.0-preview.1.23110.8, < 8.0.18.0.1
Microsoft.Extensions.Caching.MemoryNuGet
>= 8.0.0-preview.1.23110.8, < 8.0.18.0.1
Microsoft.Extensions.Caching.MemoryNuGet
>= 9.0.0-preview.1.24080.9, < 9.0.0-rc.2.24473.59.0.0-rc.2.24473.5
Microsoft.Extensions.Caching.MemoryNuGet
>= 6.0.0-preview.1.21102.12, < 6.0.26.0.2

Affected products

48

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.