CVE-2024-43485

What it actually does

In System.Text.Json 6.0.x and 8.0.x, deserializing input to a model with an [ExtensionData] property enables an algorithmic complexity attack that results in Denial of Service.

Why it matters to the business

Applications may experience sudden service outages or slowdowns when processing crafted inputs, causing operational downtime and increased resource costs until mitigated.

How an attack unfolds

An attacker identifies an endpoint that deserializes untrusted JSON into a model containing an [ExtensionData] property, then supplies a specially crafted payload that triggers excessive computation during deserialization, exhausting CPU or memory and rendering the service unavailable.

How to fix it

Update dotnet/core to the fixed commit cbc9971f29b95d0b47a2ad272305ea4af300b1fb. Rebuild and redeploy affected applications with the patched library version.

How to confirm the fix worked

Confirm the updated commit is present in the deployed System.Text.Json assembly, then test deserialization paths with both benign and edge-case JSON inputs while monitoring CPU and memory usage for stability.

Typical attack path

1. Locate applications or APIs using System.Text.Json 6.0.x or 8.0.x that deserialize to models with [ExtensionData] properties
2. Craft a JSON payload engineered to maximize algorithmic complexity during deserialization
3. Deliver the payload through public input channels such as web APIs or file uploads
4. Trigger repeated deserialization to sustain resource exhaustion and denial of service

How to detect it

Review application and web server logs for unusually long JSON deserialization times or spikes in CPU usage correlated with specific requests; inspect error logs for resource exhaustion events during model binding.

What your security team should do

• Apply the fixed commit immediately to all affected dotnet/core deployments
• Audit codebases for models using [ExtensionData] and prioritize those handling untrusted input
• Add temporary input size limits and request throttling until patches are applied