CVE-2024-43483

What it actually does

Hostile input triggers hash flooding in System.Security.Cryptography.Cose, System.IO.Packaging, and Microsoft.Extensions.Caching.Memory, causing excessive CPU and memory consumption that results in denial of service.

Why it matters to the business

Applications built on affected .NET components can be made unresponsive, leading to service outages, degraded performance for users, and potential loss of availability for dependent systems.

How an attack unfolds

An attacker crafts input containing many hash collisions and supplies it to any code path that uses the vulnerable libraries for deserialization, caching, or packaging operations; the libraries then perform expensive operations on colliding entries, exhausting resources until the process or service becomes unavailable.

How to fix it

Upgrade all affected dotnet/core packages to the fixed commit cbc9971f29b95d0b47a2ad272305ea4af300b1fb; rebuild and redeploy applications using the updated libraries; test that hash-collision resistance is enforced after the upgrade.

How to confirm the fix worked

Verify the exact commit hash cbc9971f29b95d0b47a2ad272305ea4af300b1fb is present in the built assemblies or package references; run synthetic hash-flooding test cases against the updated components and confirm resource usage remains bounded.

Typical attack path

1. Locate a network-accessible .NET application or service that accepts untrusted data into the affected libraries
2. Generate or obtain a payload containing a large number of hash-colliding keys or entries
3. Deliver the payload through the application's normal input channels (HTTP, file upload, cache injection, etc.)
4. Observe sustained high CPU or memory usage until the target process or host is exhausted

How to detect it

Review application and system logs for sustained high CPU or memory utilization on processes hosting the listed .NET libraries; correlate with incoming request patterns that contain unusually large or repetitive data structures; inspect any caching or packaging code paths for excessive hash-table growth indicators.

What your security team should do

• Immediately update all dotnet/core packages to commit cbc9971f29b95d0b47a2ad272305ea4af300b1fb across development, staging, and production environments
• Add automated dependency scanning to CI pipelines to block builds that reference vulnerable versions of the listed libraries
• Implement rate limiting and input-size validation on any endpoints that feed data into the affected components
• Monitor application resource metrics for sudden spikes that could indicate attempted hash flooding