{"id":"CVE-2023-38180","published":"2023-08-08T19:15:10Z","modified":"2026-08-10T16:18:37Z","title":"Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability","vendor":"Microsoft","product":".NET Core and Visual Studio","tier":"core","eol":null,"description":{"text":".NET and Visual Studio Denial of Service Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A denial-of-service flaw in Microsoft's .NET Core and Visual Studio, caused by uncontrolled resource consumption. An attacker with network access can trigger it without authentication or user interaction, and the result is a disruption of availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:34Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.14127,"percentile":0.96574,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2023-08-09","dueDate":"2023-08-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180;  https://nvd.nist.gov/vuln/detail/CVE-2023-38180","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-08-09","exploitedFirstSeen":"2023-08-09","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-08-09"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Aug","date":"2023-08-11"},{"url":"https://www.verizon.com/business/resources/T6c7/reports/2024-dbir-data-breach-investigations-report.pdf","date":"2024-05-01"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180","tags":["Patch","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/","tags":["Mailing List"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated network attack on public-facing software","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"NET and Visual Studio Denial of Service Vulnerability","start":1,"end":54}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Denial of service causes availability impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"NET and Visual Studio Denial of Service Vulnerability","start":1,"end":54}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":[">=6.0.0, <6.0.21","<2.1.40"],"patched":["6.0.21","2.1.40"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"}],"advisories":[{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2363","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2363","exploited":true,"exploitedSince":"2023-08-09","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499"],"provenance":"ai"}],"timeline":[{"date":"2023-08-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38180","provenance":"source"},{"date":"2023-08-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-08-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-08-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2363","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1},"priority":{"score":59.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1180 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.31,"detail":"percentile 0.9657"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-net-cwe-400","packageHistory":[{"cve":"CVE-2022-34716","published":"2022-08-09","fixed":"6.0.8","kev":false},{"cve":"CVE-2022-38013","published":"2022-09-13","fixed":"6.0.9","kev":false,"link":{"from":"CVE-2022-38013","to":"CVE-2023-38180","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64","fromFixed":"6.0.9","toFixed":"6.0.21","daysApart":329},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x86","fromFixed":"6.0.9","toFixed":"6.0.21","daysApart":329}]}},{"cve":"CVE-2023-38178","published":"2023-08-08","fixed":"7.0.10","kev":false},{"cve":"CVE-2023-38180","published":"2023-08-08","fixed":"7.0.10","kev":true},{"cve":"CVE-2024-38168","published":"2024-08-13","fixed":"8.0.8","kev":false},{"cve":"CVE-2025-55315","published":"2025-10-14","fixed":"10.0.0-rc.2.25502.107","kev":false},{"cve":"CVE-2026-42899","published":"2026-05-12","fixed":"10.0.8","kev":false}],"package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64"}}