CVE-2024-38095: Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability

July 9, 2024

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service.

References

github.com/advisories/GHSA-447r-wph3-92pm
github.com/dotnet/runtime
github.com/dotnet/runtime/security/advisories/GHSA-447r-wph3-92pm
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38095
nvd.nist.gov/vuln/detail/CVE-2024-38095

Code Behaviors & Features

Detect and mitigate CVE-2024-38095 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →