What’s Vulnerable › Vulnerabilities

CVE-2018-8409

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-13 · updated 2026-06-17

Description

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.

Affected products

• Microsoft Corporation .NET Core: from 2.1 before 2.1.4 — fixed in 2.1.4
• Microsoft .NET Core: from 2.1 before 2.1.4 — fixed in 2.1.4
• Microsoft System.IO.Pipelines: 4.5.0

How to fix

Upgrade to a fixed version: Microsoft Corporation .NET Core 2.1.4; Microsoft .NET Core 2.1.4. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/105223
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8409
• http://www.securityfocus.com/bid/105223
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8409

Get alerted when CVE-2018-8409 or the next vulnerability affects your stack