{"id":"CVE-2023-38180","published":"2023-08-08T19:15:10Z","modified":"2026-08-10T16:18:37Z","title":"Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability","vendor":"Microsoft","product":".NET Core and Visual Studio","tier":"core","eol":null,"description":{"text":".NET and Visual Studio Denial of Service Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A denial-of-service flaw in Microsoft's .NET Core and Visual Studio, caused by uncontrolled resource consumption. An attacker with network access can trigger it without authentication or user interaction, and the result is a disruption of availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:34Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.14127,"percentile":0.96564,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-08-09","dueDate":"2023-08-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180;  https://nvd.nist.gov/vuln/detail/CVE-2023-38180","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-08-09","exploitedFirstSeen":"2023-08-09","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-08-09"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Aug","date":"2023-08-11"},{"url":"https://www.verizon.com/business/resources/T6c7/reports/2024-dbir-data-breach-investigations-report.pdf","date":"2024-05-01"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180","tags":["Patch","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/","tags":["Mailing List"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated network attack on public-facing software","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"NET and Visual Studio Denial of Service Vulnerability","start":1,"end":54}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Denial of service causes availability impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"NET and Visual Studio Denial of Service Vulnerability","start":1,"end":54}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.21"],"patched":["7.0.10","6.0.21"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":[">=6.0.0, <6.0.21","<2.1.40"],"patched":["6.0.21","2.1.40"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"from":["GHSA-vmch-3w2x-vhgq"],"provenance":"source"}],"advisories":[{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=6.0.0, <6.0.21"],"patched":["6.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vmch-3w2x-vhgq","url":"https://github.com/advisories/GHSA-vmch-3w2x-vhgq","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets","vulnerableRanges":["<2.1.40"],"patched":["2.1.40"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2363","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2363","exploited":true,"exploitedSince":"2023-08-09","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499"],"provenance":"ai"}],"timeline":[{"date":"2023-08-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38180","provenance":"source"},{"date":"2023-08-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-08-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-08-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2363","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1},"priority":{"score":62.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1177 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.31,"detail":"percentile 0.9656"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-net-cwe-400","packageHistory":[{"cve":"CVE-2022-34716","published":"2022-08-09","fixed":"6.0.8","kev":false},{"cve":"CVE-2022-38013","published":"2022-09-13","fixed":"6.0.9","kev":false,"link":{"from":"CVE-2022-38013","to":"CVE-2023-38180","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64","fromFixed":"6.0.9","toFixed":"6.0.21","daysApart":329},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x86","fromFixed":"6.0.9","toFixed":"6.0.21","daysApart":329}]}},{"cve":"CVE-2023-38178","published":"2023-08-08","fixed":"7.0.10","kev":false},{"cve":"CVE-2023-38180","published":"2023-08-08","fixed":"7.0.10","kev":true},{"cve":"CVE-2024-38168","published":"2024-08-13","fixed":"8.0.8","kev":false},{"cve":"CVE-2025-55315","published":"2025-10-14","fixed":"10.0.0-rc.2.25502.107","kev":false},{"cve":"CVE-2026-42899","published":"2026-05-12","fixed":"10.0.8","kev":false}],"package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64"}}