CVE-2023-38180
Microsoft .NET 6.0, Microsoft .NET 7.0, Microsoft ASP.NET Core 2.1
Published 8 Aug 2023 · updated 10 Aug 2026 · Analyzed
7.5 High · CVSS 3.1, microsoft.com
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 9 Aug 2023, with a remediation deadline of 30 Aug 2023 for US federal agencies.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
.NET and Visual Studio Denial of Service Vulnerability
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180 · Patch, Vendor Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/ · Mailing List
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/ · Mailing List
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180 · US Government Resource