Cloudanix VulnDB

CVE-2024-43499

High · 7.5

.NET Denial of Service Vulnerability

CVSS

7.5

EPSS

2.6%

Published

Nov 12, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in some Microsoft software lets attackers crash applications by sending bad data, which can interrupt services.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to incorrect input validation.

Why it matters to the business

Applications built on .NET 9 can be made unresponsive or crash under malicious input, causing service outages and operational disruption.

How an attack unfolds

An attacker crafts and sends specially formed input to any .NET 9 application that uses the NrbfDecoder, triggering the validation flaw and resulting in denial of service.

How to fix it

Update affected .NET 9 applications to the patched version that resolves the input validation issue in NrbfDecoder.

How to confirm the fix worked

Confirm .NET 9 applications are running the version containing the input validation fix; test decoder endpoints with known-good and boundary input.

Typical attack path

  1. Locate .NET 9 application exposing NrbfDecoder
  2. Generate malformed input data
  3. Deliver input to the target decoder
  4. Induce resource exhaustion or crash

How to detect it

Review application logs and crash dumps for repeated decoder failures or resource spikes after unexpected input; no specific threat actor indicators are associated with this issue.

What your security team should do

  • Apply the .NET 9 update immediately to all affected applications
  • Review application code for NrbfDecoder usage and add input sanitization
  • Monitor for unusual resource usage or crashes in .NET 9 services

The record

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to incorrect input validation.

Affected packages

Ecosystem Package Introduced Fixed
NuGet System.Formats.Nrbf 0 9.0.0
AlmaLinux:9 aspnetcore-runtime-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 aspnetcore-runtime-dbg-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 aspnetcore-targeting-pack-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-apphost-pack-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-host 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-hostfxr-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-runtime-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-runtime-dbg-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-sdk-9.0 0 9.0.100-1.el9_5
AlmaLinux:9 dotnet-sdk-9.0-source-built-artifacts 0 9.0.100-1.el9_5
AlmaLinux:9 dotnet-sdk-aot-9.0 0 9.0.100-1.el9_5
AlmaLinux:9 dotnet-sdk-dbg-9.0 0 9.0.100-1.el9_5
AlmaLinux:9 dotnet-targeting-pack-9.0 0 9.0.0-1.el9_5
AlmaLinux:9 dotnet-templates-9.0 0 9.0.100-1.el9_5
AlmaLinux:9 netstandard-targeting-pack-2.1 0 9.0.100-1.el9_5
Bitnami dotnet 9.0.0 No fix
Bitnami dotnet 9.0.0 9.0.1
Bitnami dotnet-sdk 9.0.0 No fix
Bitnami dotnet-sdk 9.0.0 9.0.1
Chainguard aspnet-9-runtime 0 9.0.2-r0
Chainguard aspnet-9-runtime-default 0 9.0.2-r0
Chainguard aspnet-9-targeting-pack 0 9.0.2-r0
Chainguard dotnet-9 0 9.0.2-r0
Chainguard dotnet-9-aot 0 9.0.2-r0
Chainguard dotnet-9-runtime 0 9.0.2-r0
Chainguard dotnet-9-runtime-default 0 9.0.2-r0
Chainguard dotnet-9-sdk 0 9.0.2-r0
Chainguard dotnet-9-sdk-default 0 9.0.2-r0
Chainguard dotnet-9-targeting-pack 0 9.0.2-r0
Chainguard dotnet-bootstrap-9 0 9.0.200-r0
Chainguard netstandard-9-targeting-pack 0 9.0.2-r0
Red Hat:enterprise_linux:9::appstream aspnetcore-runtime-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream aspnetcore-runtime-dbg-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream aspnetcore-targeting-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-apphost-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-apphost-pack-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-host 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-host-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-hostfxr-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-hostfxr-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-runtime-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-runtime-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-runtime-dbg-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-9.0-source-built-artifacts 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-aot-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-aot-9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-sdk-dbg-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-targeting-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet-templates-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream dotnet9.0-debugsource 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::appstream netstandard-targeting-pack-2.1 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb aspnetcore-runtime-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb aspnetcore-runtime-dbg-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb aspnetcore-targeting-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-apphost-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-apphost-pack-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-host 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-host-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-hostfxr-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-hostfxr-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-runtime-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-runtime-9.0-debuginfo 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-runtime-dbg-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-9.0-source-built-artifacts 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-aot-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-aot-9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-sdk-dbg-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-targeting-pack-9.0 0 0:9.0.0-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet-templates-9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet9.0 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet9.0-debuginfo 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb dotnet9.0-debugsource 0 0:9.0.100-1.el9_5
Red Hat:enterprise_linux:9::crb netstandard-targeting-pack-2.1 0 0:9.0.100-1.el9_5
Ubuntu:22.04:LTS dotnet7 0 No fix
Ubuntu:24.10 dotnet9 0 9.0.100-9.0.0-0ubuntu1~24.10.1
Wolfi aspnet-9-runtime 0 9.0.2-r0
Wolfi aspnet-9-runtime-default 0 9.0.2-r0
Wolfi aspnet-9-targeting-pack 0 9.0.2-r0
Wolfi dotnet-9 0 9.0.2-r0
Wolfi dotnet-9-aot 0 9.0.2-r0
Wolfi dotnet-9-runtime 0 9.0.2-r0
Wolfi dotnet-9-runtime-default 0 9.0.2-r0
Wolfi dotnet-9-sdk 0 9.0.2-r0
Wolfi dotnet-9-sdk-default 0 9.0.2-r0
Wolfi dotnet-9-targeting-pack 0 9.0.2-r0
Wolfi dotnet-bootstrap-9 0 9.0.200-r0
Wolfi netstandard-9-targeting-pack 0 9.0.2-r0

Related vulnerabilities