{"id":"CVE-2022-38013","aliases":["BIT-dotnet-2022-38013","BIT-dotnet-sdk-2022-38013","GHSA-r8m2-4x37-6592"],"url":"https://o3.security/vulnerability/CVE-2022-38013","summary":".NET Denial of Service Vulnerability","details":"Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding.\n\n## <a name=\"affected-software\"></a>Affected software\n* Any .NET 6.0 application running on .NET 6.0.8 or earlier.\n* Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier.\nIf your application uses the following package versions, ensure you update to the latest version of .NET.\n### <a name=\"ASP.NET Core 3.1\"></a>.NET Core 3.1\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29\n### <a name=\".NET 6\"></a>.NET 6\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9\n\n\n\n### Other\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/234\nAn Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953\nMSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013","published":"2022-09-13T19:15:12.867Z","modified":"2026-07-08T06:04:01.761369358Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.03248,"percentile":0.8741,"asOf":"2026-08-27"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-arm","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-x64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.osx-x64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-arm","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-arm64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-x64","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-x86","fixedVersion":"3.1.29"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-arm","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.linux-x64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.osx-x64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-arm","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-arm64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-x64","fixedVersion":"6.0.9"},{"ecosystem":"NuGet","name":"Microsoft.AspNetCore.App.Runtime.win-x86","fixedVersion":"6.0.9"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M/"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013"},{"type":"FIX","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38013"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r8m2-4x37-6592"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38013"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:04:01.761369358Z"}}