{"id":"CVE-2023-36799","published":"2023-09-12T16:58:38Z","modified":"2025-10-30T18:18:07Z","title":".NET Core and Visual Studio Denial of Service Vulnerability","vendor":"Microsoft","product":".NET 6.0","tier":"tail","description":{"text":".NET Core and Visual Studio Denial of Service Vulnerability","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04637,"percentile":0.91683,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799","tags":["vendor-advisory"]}],"priority":{"score":22.9,"factors":[{"name":"EPSS percentile","points":18.34},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"microsoft","affectedVersions":[{"vendor":"Microsoft","product":".NET 6.0","versions":[">= 6.0.0, < 6.0.24"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[">= 7.0.0, < 7.0.13"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[">= 17.2.0, < 17.2.21"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[">= 17.4.0, < 17.4.13"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.7","versions":[">= 17.7.0, < 17.6.9"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[">= 17.6.0, < 17.6.9"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[">= 7.2.0, < 7.2.14"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[">= 7.3.0, < 7.2.14"]}],"affected":[{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm64","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-x64","vulnerableRanges":[">=7.0.0, <7.0.11",">=6.0.0, <6.0.22"],"patched":["7.0.11","6.0.22"],"from":["GHSA-h3hv-63q5-jgpr"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2515","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-microsoft-net-6-0-cve-2023-36799","packageHistory":[{"cve":"CVE-2023-24936","published":"2023-06-14","fixed":"7.0.7","kev":false,"link":{"from":"CVE-2023-24936","to":"CVE-2023-36799","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm","fromFixed":"6.0.18","toFixed":"6.0.22","daysApart":90},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm","fromFixed":"7.0.7","toFixed":"7.0.11","daysApart":90}]}},{"cve":"CVE-2023-29331","published":"2023-06-14","fixed":"7.0.7","kev":false},{"cve":"CVE-2023-33128","published":"2023-06-13","fixed":"7.0.7","kev":false},{"cve":"CVE-2023-36799","published":"2023-09-12","fixed":"7.0.11","kev":false},{"cve":"CVE-2024-21392","published":"2024-03-12","fixed":"8.0.3","kev":false,"link":{"from":"CVE-2023-36799","to":"CVE-2024-21392","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm","fromFixed":"7.0.11","toFixed":"7.0.17","daysApart":182},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm64","fromFixed":"7.0.11","toFixed":"7.0.17","daysApart":182},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same package + description similarity"}]}},{"cve":"CVE-2024-30045","published":"2024-05-14","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-62899","published":"2026-08-11","fixed":"10.0.11","kev":false}],"package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm"}}