CVE-2017-0247

HIGH

ASP.NET Core Mvc < 1.0.4 and 1.1.x < 1.1.3 - Denial of Service via Unicode Non-Character Encoding

Title source: llm
STIX 2.1

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://technet.microsoft.com/en-us/library/security/4021279.aspx
Technical Description, Third Party Advisory x_refsource_misc
https://github.com/aspnet/Announcements/issues/239

Scores

CVSS v3 7.5
EPSS 0.1112
EPSS Percentile 93.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (50)
microsoft/asp.net_model_view_controller 1.0.0
microsoft/asp.net_model_view_controller 1.0.1
microsoft/asp.net_model_view_controller 1.0.2
microsoft/asp.net_model_view_controller 1.0.3
microsoft/asp.net_model_view_controller 1.1.0
microsoft/asp.net_model_view_controller 1.1.1
microsoft/asp.net_model_view_controller 1.1.2
microsoft/microsoft.aspnetcore.mvc.abstractions 1.0.0
microsoft/microsoft.aspnetcore.mvc.abstractions 1.0.1
microsoft/microsoft.aspnetcore.mvc.abstractions 1.0.2
... and 40 more
Published May 12, 2017
Tracked Since Feb 18, 2026