CVE-2017-0247
High · 7.5CVSS
7.5
EPSS
16.9%
Published
May 12, 2017
CISA due date
—
The record
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | Microsoft.AspNetCore.Mvc | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Abstractions | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Abstractions | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.ApiExplorer | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.ApiExplorer | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Core | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Core | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Cors | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Cors | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.DataAnnotations | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.DataAnnotations | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Formatters.Json | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Formatters.Json | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Formatters.Xml | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Formatters.Xml | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Localization | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Localization | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Razor | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Razor | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.Razor.Host | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.Razor.Host | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.TagHelpers | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.TagHelpers | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.ViewFeatures | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.ViewFeatures | 1.1.0 | 1.1.3 |
| NuGet | Microsoft.AspNetCore.Mvc.WebApiCompatShim | 1.0.0 | 1.0.4 |
| NuGet | Microsoft.AspNetCore.Mvc.WebApiCompatShim | 1.1.0 | 1.1.3 |
| NuGet | System.Net.Http | 4.1.1 | 4.1.2 |
| NuGet | System.Net.Http | 4.3.1 | 4.3.2 |
| NuGet | System.Net.Http.WinHttpHandler | 4.0.0 | 4.0.1 |
| NuGet | System.Net.Http.WinHttpHandler | 4.3.0 | 4.5.4 |
| NuGet | System.Net.Security | 4.0.0 | 4.0.1 |
| NuGet | System.Net.Security | 4.3.0 | 4.3.1 |
| NuGet | System.Net.WebSockets.Client | 4.0.0 | 4.0.1 |
| NuGet | System.Net.WebSockets.Client | 4.3.0 | 4.3.1 |
| NuGet | System.Text.Encodings.Web | 4.0.0 | 4.0.1 |
| NuGet | System.Text.Encodings.Web | 4.3.0 | 4.3.1 |
| nuget | Microsoft.AspNet.Mvc | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNet.Mvc | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Abstractions | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Abstractions | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.ApiExplorer | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.ApiExplorer | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Core | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Core | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Cors | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Cors | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.DataAnnotations | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.DataAnnotations | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Formatters.Json | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Formatters.Json | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Formatters.Xml | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Formatters.Xml | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Localization | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Localization | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Razor | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Razor | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.Razor.Host | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.Razor.Host | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.TagHelpers | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.TagHelpers | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.ViewFeatures | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.ViewFeatures | 1.1.0 | 1.1.3 |
| nuget | Microsoft.AspNetCore.Mvc.WebApiCompatShim | 1.0.0 | 1.0.4 |
| nuget | Microsoft.AspNetCore.Mvc.WebApiCompatShim | 1.1.0 | 1.1.3 |
| nuget | System.Net.Http | 4.1.1 | No fix |
| nuget | System.Net.Http | 4.3.1 | No fix |
| nuget | System.Net.Http.WinHttpHandler | 4.0.0 | No fix |
| nuget | System.Net.Http.WinHttpHandler | 4.3.0 | 4.5.4 |
| nuget | System.Net.Security | 4.0.0 | No fix |
| nuget | System.Net.Security | 4.3.0 | No fix |
| nuget | System.Net.WebSockets.Client | 4.0.0 | No fix |
| nuget | System.Net.WebSockets.Client | 4.3.0 | No fix |
| nuget | System.Text.Encodings.Web | 4.0.0 | No fix |
| nuget | System.Text.Encodings.Web | 4.3.0 | No fix |
Related vulnerabilities
- CVE-2017-8700 ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing… Also affects Microsoft.AspNetCore.Mvc.Core
- CVE-2014-4075 Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model… Also affects Microsoft.AspNet.Mvc
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20