What’s Vulnerable › Vulnerabilities

CVE-2021-1721: .NET Core and Visual Studio Denial of Service Vulnerability

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-25 · updated 2026-06-17

Description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected products

• Microsoft .NET: from 5.0 through 5.0.2
• Microsoft Corporation .NET Core: from 2.1 through 2.1.24; from 3.1 through 3.1.11
• Microsoft PowerShell Core: 7.0, 7.1
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): from 15.0 through 15.9
• Microsoft Visual Studio 2019: from 16.0 through 16.8
• Microsoft .NET 5.0: from 5.0.0 before publication — fixed in publication
• Microsoft .NET Core 2.1: from 2.1 before publication — fixed in publication
• Microsoft .NET Core 3.1: from 3.1 before publication — fixed in publication
• Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3): from 16.0 before publication — fixed in publication
• Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6): from 16.0.0 before publication — fixed in publication
• Microsoft Visual Studio 2019 version 16.8: from 16.0 before publication — fixed in publication
• Microsoft PowerShell Core 7.0: from 7.0.0 before publication — fixed in publication
• Microsoft PowerShell Core 7.1: from 7.1.0 before publication — fixed in publication
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): from 15.9.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft .NET 5.0 publication; Microsoft .NET Core 2.1 publication; Microsoft .NET Core 3.1 publication; Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) publication; Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) publication; Microsoft Visual Studio 2019 version 16.8 publication; Microsoft PowerShell Core 7.0 publication; Microsoft PowerShell Core 7.1 publication; Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) publication. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721

Get alerted when CVE-2021-1721 or the next vulnerability affects your stack