VYPR
← All advisories
High severityNVD Advisory· Published Oct 8, 2024· Updated Jul 8, 2025

.NET and Visual Studio Denial of Service Vulnerability

CVE-2024-43485

Description

.NET and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial of service vulnerability in System.Text.Json affects .NET applications using [ExtensionData] property, exploitable via crafted JSON input.

Vulnerability

Details

CVE-2024-43485 is an algorithmic complexity vulnerability in the System.Text.Json library, affecting .NET 6.0.x and 8.0.x. The flaw resides in the deserialization of JSON input into models that include an [ExtensionData] property. When processing specially crafted JSON payloads, the library can be forced into excessive computational work, leading to a denial of service condition [1][2][3].

Exploitation

An attacker can exploit this vulnerability by sending a malicious JSON payload to an application that deserializes it into a model with an [ExtensionData] property. No authentication is required if the endpoint is publicly accessible. The attack does not require any special network position beyond the ability to send HTTP requests to the target service [1][2][3].

Impact

Successful exploitation results in a denial of service, causing the affected application to become unresponsive or crash. This can disrupt service availability for legitimate users. The impact is limited to applications that use the [ExtensionData] feature; models without this property are not vulnerable [1][2][3].

Mitigation

Microsoft has released patches for the affected packages. Users should update to .NET 8.0.9 or later, .NET 6.0.34 or later, or update the System.Text.Json package to version 8.0.5 (for .NET 8) or 6.0.10 (for .NET 6). Visual Studio users will be prompted to update. No workarounds are available for vulnerable configurations [1][2][3].

References
  1. Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability
  2. Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability
  3. Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.Text.JsonNuGet
>= 8.0.0, < 8.0.58.0.5
System.Text.JsonNuGet
>= 6.0.0, < 6.0.106.0.10

Affected products

36

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.