CVE-2009-1536

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 51.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-12 · updated 2026-06-16
Weakness: CWE-20

Description

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."

Affected products

Microsoft .NET Framework: 2.0-sp1, 2.0-sp2, 3.5, 3.5-sp1
Microsoft Windows Server 2008: all versions
Microsoft Windows Vista: all versions

References

http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127

Get alerted when CVE-2009-1536 or the next vulnerability affects your stack