CVE-2022-38013 — Microsoft.AspNetCore.App.…
HIGHCVE-2022-38013 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in Microsoft.AspNetCore.App.Runtime.linux-arm. A fix is available for Microsoft.AspNetCore.App.Runtime.linux-arm — see the affected versions and patch details below.
.NET Denial of Service Vulnerability
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-38013.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
Microsoft.AspNetCore.App.Runtime.linux-arm.NETMicrosoft.AspNetCore.App.Runtime.linux-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-x64.NETMicrosoft.AspNetCore.App.Runtime.linux-x64.NETMicrosoft.AspNetCore.App.Runtime.osx-x64.NETMicrosoft.AspNetCore.App.Runtime.win-arm.NETMicrosoft.AspNetCore.App.Runtime.win-arm64+14 moreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding.
<a name="affected-software"></a>Affected software
- Any .NET 6.0 application running on .NET 6.0.8 or earlier.
- Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET.
<a name="ASP.NET Core 3.1"></a>.NET Core 3.1
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 3.1.5, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 3.1.0, < 3.1.29 | 3.1.29 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 3.1.0, < 3.1.29 | 3.1.29 |
<a name=".NET 6"></a>.NET 6
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 5.0.1, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 6.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 5.0.0, < 6.0.9 | 6.0.9 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 5.0.0, < 6.0.9 | 6.0.9 |
Other
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/234 An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.linux-arm | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 3.1.29 |
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.linux-arm64 | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 3.1.29 |
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 3.1.29 |
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 3.1.29 |
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.linux-x64 | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 3.1.29 |
| .NETNuGet | Microsoft.AspNetCore.App.Runtime.osx-x64 | ≥ 3.1.0&&< 3.1.29 | 3.1.29dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 3.1.29 |
Affected Products
fedorafedoraproject.netmicrosoft.net coremicrosoftvisual studio 2019microsoftvisual studio 2022microsoftDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.AspNetCore.App.Runtime.linux-arm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.AspNetCore.App.Runtime.linux-arm to 3.1.29 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-38013 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| .NET Core on Red Hat Enterprise Linux | rh-dotnet31-dotnet-0:3.1.423-1.el7_9 | RHSA-2022:6522 |
| .NET Core on Red Hat Enterprise Linux | rh-dotnet60-dotnet-0:6.0.109-1.el7_9 | RHSA-2022:6520 |
| Red Hat Enterprise Linux 8 | dotnet3.1-0:3.1.423-1.el8_6 | RHSA-2022:6523 |
| Red Hat Enterprise Linux 8 | dotnet6.0-0:6.0.109-1.el8_6 | RHSA-2022:6539 |
| Red Hat Enterprise Linux 9 | dotnet6.0-0:6.0.109-1.el9_0 | RHSA-2022:6521 |
Frequently Asked Questions
Is CVE-2022-38013 in your dependencies?
Find it across NuGet, including transitive dependencies.