# CVE-2023-38180

.NET and Visual Studio Denial of Service Vulnerability

- Page: https://www.vulneraibility.com/cve/CVE-2023-38180
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2023-08-09; CISA due date 2023-08-30
- EPSS: 14.13% (percentile 96.6)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2024-07-24)
- Weakness: CWE-400
- Also known as: GHSA-vmch-3w2x-vhgq
- Published: 2023-08-08

## Affected versions

- ASP.NET Core: affected >= 2.1.0 and < 2.1.40; fixed in 2.1.40 (Bitnami advisory, via OSV)
- Microsoft ASP.NET Core 2.1: affected >= 2.0 and < 2.1.40
- Microsoft Microsoft Visual Studio 2022 version 17.2: affected >= 17.2.0 and < 17.2.18
- Microsoft Microsoft Visual Studio 2022 version 17.4: affected >= 17.4.0 and < 17.4.10
- Microsoft Microsoft Visual Studio 2022 version 17.6: affected >= 17.6.0 and < 17.6.6
- .NET: affected >= 6.0.0 and < 6.0.21; >= 7.0.0 and < 7.0.10; fixed in 6.0.21, 7.0.10 (Bitnami advisory, via OSV)
- Microsoft .NET 6.0: affected >= 6.0.0 and < 6.0.21
- Microsoft .NET 7.0: affected >= 7.0.0 and < 7.0.10
- .NET SDK: affected >= 6.0.0 and < 6.0.21; >= 7.0.0 and < 7.0.10; fixed in 6.0.21, 7.0.10 (Bitnami advisory, via OSV)

A version outside these ranges is not a statement that it is unaffected.

## References

- [patch] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.