{"containers": {"cna": {"title": "ASP.NET Core Denial of Service Vulnerability", "datePublic": "2020-05-12T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.9.0", "versionEndExcluding": "publication"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0", "versionEndExcluding": "publication"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0", "versionEndExcluding": "publication"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0", "versionEndExcluding": "publication"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "publication"}]}]}], "affected": [{"vendor": "Microsoft", "product": "ASP.NET Core 3.1", "versions": [{"version": "3.0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)", "versions": [{"version": "15.9.0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.0", "versions": [{"version": "16.0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)", "versions": [{"version": "16.0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.5", "versions": [{"version": "16.0", "lessThan": "publication", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application.\nThe update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Denial of Service", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-19T16:34:12.596Z"}, "references": [{"name": "ASP.NET Core Denial of Service Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1161"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:25:01.313Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1161"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2020-1161", "datePublished": "2020-05-21T22:53:28.000Z", "dateReserved": "2019-11-04T00:00:00.000Z", "dateUpdated": "2026-08-19T16:34:12.596Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "ASP.NET Core 3.1", "vendor": "Microsoft", "versions": [{"lessThan": "publication", "status": "affected", "version": "3.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)", "vendor": "Microsoft", "versions": [{"lessThan": "publication", "status": "affected", "version": "15.9.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2019 version 16.0", "vendor": "Microsoft", "versions": [{"lessThan": "publication", "status": "affected", "version": "16.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)", "vendor": "Microsoft", "versions": [{"lessThan": "publication", "status": "affected", "version": "16.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2019 version 16.5", "vendor": "Microsoft", "versions": [{"lessThan": "publication", "status": "affected", "version": "16.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:asp.net_core:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "5FE4072E-3226-435C-BC61-A775D3EF2822", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0B3CF5E-F740-4A66-8173-10FEE4DCD08D", "versionEndIncluding": "15.9", "versionStartIncluding": "15.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BF04E9A-C8B5-4E56-81DB-D22876E31161", "versionEndIncluding": "16.5", "versionStartIncluding": "16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application.\nThe update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests."}, {"lang": "es", "value": "Existe una vulnerabilidad denegaci\u00f3n de servicio cuando ASP.NET Core maneja inapropiadamente las peticiones web, tambi\u00e9n se conoce como \"ASP.NET Core Denial of Service Vulnerability\"."}], "id": "CVE-2020-1161", "lastModified": "2026-08-19T17:17:28.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-05-21T23:15:17.603", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1161"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1161"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Microsoft for reporting this issue.", "affected_release": [{"advisory": "RHSA-2020:2249", "cpe": "cpe:/a:redhat:rhel_dotnet:3.1::el7", "package": "rh-dotnet31-dotnet-0:3.1.104-2.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2020-05-21T00:00:00Z"}, {"advisory": "RHSA-2020:2250", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet3.1-0:3.1.104-2.el8_2", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-05-21T00:00:00Z"}], "bugzilla": {"description": "dotnet: Denial of service due to infinite loop", "id": "1827645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1827645"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.", "An infinite loop was found in the HTTP Routing component of Microsoft.AspNetCore.App, which could be exploited by a remote, unauthenticated attacker. This flaw allows an attacker without special privileges to send crafted requests to a machine running an ASP.NET Core application, triggering the infinite loop and causing a denial of service in that application, for example, a web server."], "name": "CVE-2020-1161", "package_state": [{"cpe": "cpe:/a:redhat:rhel_dotnet:2.1", "fix_state": "Not affected", "package_name": "rh-dotnet21", "product_name": ".NET Core 2.1 on Red Hat Enterprise Linux"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet3.0", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2020-05-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-1161\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1161\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1161"], "threat_severity": "Important"}