PT-2024-4734 · Microsoft+8 · System.Text.Json+10
Published
2024-07-09
·
Updated
2024-12-13
·
CVE-2024-30105
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
.NET Core versions prior to 8.x
Visual Studio versions prior to 8.x
Description:
The issue is related to an uncontrolled resource consumption in the JsonSerializer.DeserializeAsyncEnumerable method of the System.Text.Json library in Microsoft .NET and Visual Studio. This can be exploited by a remote attacker to cause a denial of service. The vulnerability arises when the
JsonSerializer.DeserializeAsyncEnumerable method processes untrusted input, potentially leading to resource exhaustion.Recommendations:
For .NET Core versions prior to 8.x, update to version 8.x or later to resolve the issue.
For Visual Studio versions prior to 8.x, update to version 8.x or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
JsonSerializer.DeserializeAsyncEnumerable method until a patch is available.Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Net Core
Red Hat
Red Os
Rocky Linux
System.Text.Json
Ubuntu
Visual Studio