CVE-2024-30105
High · 7.5CVSS
7.5
EPSS
2.9%
Published
Jul 9, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A flaw in .NET software lets attackers remotely shut down affected applications without any login, causing outages until the software is updated.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Library
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Remote unauthenticated attacker can trigger a denial of service condition against .NET Core or Visual Studio components by sending specially crafted network input that causes the application to crash or become unresponsive.
Why it matters to the business
Service outages and degraded availability for applications built on affected .NET runtimes, leading to downtime, lost productivity, and potential revenue impact until systems are restored or updated.
How an attack unfolds
An attacker locates publicly reachable .NET services or development endpoints, crafts malicious requests matching the vulnerable code path, and repeatedly sends them to exhaust resources or force crashes without needing credentials or user interaction.
How to fix it
Upgrade affected Debian 13 packages to version 6.8.9-1 or later; apply the same update across all .NET Core and Visual Studio deployments as soon as packages are available for each distribution.
How to confirm the fix worked
Verify installed package versions match or exceed 6.8.9-1 on Debian 13 systems; re-test affected services with benign workloads to confirm stability and absence of the prior crash behavior.
Typical attack path
- Scan for exposed .NET Core or Visual Studio-related services on the network
- Identify instances running vulnerable versions prior to the fixed package
- Send crafted network payloads that exercise the denial-of-service flaw
- Observe service crash or sustained unresponsiveness confirming successful exploitation
How to detect it
Review application and system logs for unexpected .NET process terminations or high CPU/memory spikes coinciding with inbound requests; correlate with network traffic patterns to services running the vulnerable runtime.
What your security team should do
- Immediately schedule upgrades to the fixed package versions on all Debian 13 hosts
- Prioritize internet-facing .NET services for patching due to the network attack vector
- Monitor for availability alerts on .NET workloads while remediation is in progress
The record
.NET Core and Visual Studio Denial of Service Vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | System.Text.Json | 7.0.0 | 8.0.4 |
| AlmaLinux:8 | aspnetcore-runtime-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | aspnetcore-runtime-dbg-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | aspnetcore-targeting-pack-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:8 | dotnet-apphost-pack-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-host | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-hostfxr-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-runtime-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-runtime-dbg-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-sdk-8.0 | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:8 | dotnet-sdk-8.0-source-built-artifacts | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:8 | dotnet-sdk-dbg-8.0 | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:8 | dotnet-targeting-pack-8.0 | 0 | 8.0.7-1.el8_10 |
| AlmaLinux:8 | dotnet-templates-8.0 | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:8 | netstandard-targeting-pack-2.1 | 0 | 8.0.107-1.el8_10 |
| AlmaLinux:9 | aspnetcore-runtime-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | aspnetcore-runtime-dbg-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | aspnetcore-targeting-pack-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-apphost-pack-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-host | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-hostfxr-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-runtime-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-runtime-dbg-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-sdk-8.0 | 0 | 8.0.107-1.el9_4 |
| AlmaLinux:9 | dotnet-sdk-8.0-source-built-artifacts | 0 | 8.0.107-1.el9_4 |
| AlmaLinux:9 | dotnet-sdk-dbg-8.0 | 0 | 8.0.107-1.el9_4 |
| AlmaLinux:9 | dotnet-targeting-pack-8.0 | 0 | 8.0.7-1.el9_4 |
| AlmaLinux:9 | dotnet-templates-8.0 | 0 | 8.0.107-1.el9_4 |
| AlmaLinux:9 | netstandard-targeting-pack-2.1 | 0 | 8.0.107-1.el9_4 |
| Bitnami | dotnet | 8.0.0 | 8.0.7 |
| Bitnami | dotnet | 8.0.0 | 8.0.8 |
| Bitnami | dotnet-sdk | 8.0.0 | 8.0.7 |
| Bitnami | dotnet-sdk | 8.0.0 | 8.0.8 |
| Chainguard | aspnet-8-runtime | 0 | 8.0.7-r0 |
| Chainguard | aspnet-8-runtime-default | 0 | 8.0.7-r0 |
| Chainguard | aspnet-8-targeting-pack | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8 | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8-runtime | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8-runtime-default | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8-sdk | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8-sdk-default | 0 | 8.0.7-r0 |
| Chainguard | dotnet-8-targeting-pack | 0 | 8.0.7-r0 |
| Chainguard | netstandard-8-targeting-pack | 0 | 8.0.7-r0 |
| Red Hat:enterprise_linux:8::appstream | aspnetcore-runtime-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | aspnetcore-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | aspnetcore-targeting-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-apphost-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-apphost-pack-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-host | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-host-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-hostfxr-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-hostfxr-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-runtime-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-runtime-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-sdk-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-sdk-8.0-debuginfo | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-sdk-8.0-source-built-artifacts | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-sdk-dbg-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-targeting-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet-templates-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet8.0-debuginfo | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | dotnet8.0-debugsource | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::appstream | netstandard-targeting-pack-2.1 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | aspnetcore-runtime-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | aspnetcore-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | aspnetcore-targeting-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-apphost-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-apphost-pack-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-host | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-host-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-hostfxr-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-hostfxr-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-runtime-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-runtime-8.0-debuginfo | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-sdk-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-sdk-8.0-debuginfo | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-sdk-8.0-source-built-artifacts | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-sdk-dbg-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-targeting-pack-8.0 | 0 | 0:8.0.7-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet-templates-8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet8.0 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet8.0-debuginfo | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | dotnet8.0-debugsource | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:8::crb | netstandard-targeting-pack-2.1 | 0 | 0:8.0.107-1.el8_10 |
| Red Hat:enterprise_linux:9::appstream | aspnetcore-runtime-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | aspnetcore-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | aspnetcore-targeting-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-apphost-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-apphost-pack-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-host | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-host-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-hostfxr-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-hostfxr-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-runtime-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-runtime-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-sdk-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-sdk-8.0-debuginfo | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-sdk-8.0-source-built-artifacts | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-sdk-dbg-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-targeting-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet-templates-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet8.0-debuginfo | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | dotnet8.0-debugsource | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::appstream | netstandard-targeting-pack-2.1 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | aspnetcore-runtime-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | aspnetcore-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | aspnetcore-targeting-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-apphost-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-apphost-pack-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-host | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-host-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-hostfxr-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-hostfxr-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-runtime-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-runtime-8.0-debuginfo | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-runtime-dbg-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-sdk-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-sdk-8.0-debuginfo | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-sdk-8.0-source-built-artifacts | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-sdk-dbg-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-targeting-pack-8.0 | 0 | 0:8.0.7-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet-templates-8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet8.0 | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet8.0-debuginfo | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | dotnet8.0-debugsource | 0 | 0:8.0.107-1.el9_4 |
| Red Hat:enterprise_linux:9::crb | netstandard-targeting-pack-2.1 | 0 | 0:8.0.107-1.el9_4 |
| Rocky Linux:8 | dotnet8.0 | 0 | 0:8.0.107-1.el8_10 |
| Rocky Linux:9 | dotnet8.0 | 0 | 0:8.0.107-1.el9_4 |
| Ubuntu:22.04:LTS | dotnet6 | 0 | 6.0.132-0ubuntu1~22.04.1 |
| Ubuntu:22.04:LTS | dotnet7 | 0 | No fix |
| Ubuntu:22.04:LTS | dotnet8 | 0 | 8.0.107-8.0.7-0ubuntu1~22.04.1 |
| Ubuntu:23.10 | dotnet6 | 0 | 6.0.132-0ubuntu1~23.10.1 |
| Ubuntu:23.10 | dotnet8 | 0 | 8.0.107-8.0.7-0ubuntu1~23.10.1 |
| Ubuntu:24.04:LTS | dotnet8 | 0 | 8.0.107-8.0.7-0ubuntu1~24.04.1 |
| Wolfi | aspnet-8-runtime | 0 | 8.0.7-r0 |
| Wolfi | aspnet-8-runtime-default | 0 | 8.0.7-r0 |
| Wolfi | aspnet-8-targeting-pack | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8 | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8-runtime | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8-runtime-default | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8-sdk | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8-sdk-default | 0 | 8.0.7-r0 |
| Wolfi | dotnet-8-targeting-pack | 0 | 8.0.7-r0 |
| Wolfi | netstandard-8-targeting-pack | 0 | 8.0.7-r0 |
| nuget | System.Text.Json | 7.0.0 | 8.0.4 |
Related vulnerabilities
- CVE-2024-43485 Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability Also affects System.Text.Json
- CVE-2025-55315 Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-43483 Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-43484 Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-38229 Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-30045 .NET and Visual Studio Remote Code Execution Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-30046 Visual Studio Denial of Service Vulnerability Also affects aspnetcore-runtime-8.0
- CVE-2024-21392 .NET and Visual Studio Denial of Service Vulnerability Also affects aspnetcore-runtime-8.0