{"id":"CVE-2023-33141","aliases":["GHSA-jrjw-qgr2-wfcg"],"url":"https://o3.security/vulnerability/CVE-2023-33141","summary":"YARP Denial of Service Vulnerability","details":"### Impact\nA denial of service vulnerability exists in YARP.\n\n### Patches\nIf you're using YARP 1.x, you should update to NuGet package version [1.1.2](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2).\nIf you're using YARP 2.0.0, you should update to NuGet package version [2.0.1](https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1).\n\n\nYou can do so by updating the `PackageReference` in your `.csproj` file\n```diff\n<ItemGroup>\n- <PackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.0\" />\n- <PackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.0\" />\n+ <PackageReference Include=\"Yarp.ReverseProxy\" Version=\"2.0.1\" />\n+ <PackageReference Include=\"Yarp.Telemetry.Consumption\" Version=\"2.0.1\" />\n</ItemGroup>\n```\nor by selecting `2.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)\n\n### References\n\n[CVE-2023-33141](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141)\n","published":"2023-06-23T02:15:09.513Z","modified":"2026-10-24T10:30:44.830959641Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Yarp.ReverseProxy","fixedVersion":"1.1.2"},{"ecosystem":"NuGet","name":"Yarp.ReverseProxy","fixedVersion":"2.0.1"}],"fix":null,"references":[{"type":"FIX","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141"},{"type":"WEB","url":"https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-jrjw-qgr2-wfcg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33141"},{"type":"PACKAGE","url":"https://github.com/microsoft/reverse-proxy"},{"type":"WEB","url":"https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2"},{"type":"WEB","url":"https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:44.830959641Z"}}