{"id":"CVE-2022-26924","aliases":["GHSA-8xc6-g8xw-h2c4"],"url":"https://o3.security/vulnerability/CVE-2022-26924","summary":"YARP Denial of Service Vulnerability","details":"### Impact\n\nA denial of service vulnerability exists in how YARP processes input.\n\n### Patches\n\nIf you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).\nIf you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n<ItemGroup>\n- <PackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.0\" />\n- <PackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.0\" />\n+ <PackageReference Include=\"Yarp.ReverseProxy\" Version=\"1.0.1\" />\n+ <PackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"1.0.1\" />\n</ItemGroup>\n```\nor by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)\n\n### References\n\n[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)","published":"2022-04-15T19:15:15.697Z","modified":"2026-08-27T03:48:58.770146424Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.03191,"percentile":0.86877,"asOf":"2026-08-07"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Yarp.ReverseProxy","fixedVersion":"1.0.1"},{"ecosystem":"NuGet","name":"Yarp.ReverseProxy","fixedVersion":"1.1.0-rc.1.22211.2"}],"fix":{"url":"https://github.com/microsoft/reverse-proxy/commit/11e6272da17beb03d0b44a19d3c4f1ffa52b7c38","label":"microsoft/reverse-proxy@11e6272"},"references":[{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924"},{"type":"WEB","url":"https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-8xc6-g8xw-h2c4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26924"},{"type":"WEB","url":"https://github.com/microsoft/reverse-proxy/commit/11e6272da17beb03d0b44a19d3c4f1ffa52b7c38"},{"type":"PACKAGE","url":"https://github.com/microsoft/reverse-proxy"},{"type":"WEB","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26924"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:48:58.770146424Z"}}