What’s Vulnerable › Vulnerabilities

CVE-2022-38013: .NET Core and Visual Studio Denial of Service Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-13 · updated 2026-06-17
• Weakness: CWE-400

Description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected products

• Fedoraproject Fedora: 35, 36, 37
• Microsoft .NET: 6.0.0
• Microsoft Corporation .NET Core: 3.1
• Microsoft Visual Studio 2019: 16.9, 16.11
• Microsoft Visual Studio 2022 version 17.14: 17.0, 17.2, 17.3
• Microsoft .NET 6.0: from 6.0.0 before 6.0.9 — fixed in 6.0.9
• Microsoft .NET Core 3.1: from 3.1 before 3.1.29 — fixed in 3.1.29
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10): from 16.11.0 before 16.11.19 — fixed in 16.11.19
• Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8): from 15.0.0 before 16.9.25 — fixed in 16.9.25
• Microsoft Visual Studio 2022 version 17.0: from 17.0.0 before 17.0.14 — fixed in 17.0.14
• Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.8 — fixed in 17.2.8
• Microsoft Visual Studio 2022 version 17.3: from 17.0.0 before 17.3.4 — fixed in 17.3.4
• Microsoft Visual Studio 2022 for Mac version 17.3: from 17.3 before 17.3.5 — fixed in 17.3.5

How to fix

Upgrade to a fixed version: Microsoft .NET 6.0 6.0.9; Microsoft .NET Core 3.1 3.1.29; Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.19; Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) 16.9.25; Microsoft Visual Studio 2022 version 17.0 17.0.14; Microsoft Visual Studio 2022 version 17.2 17.2.8; Microsoft Visual Studio 2022 version 17.3 17.3.4; Microsoft Visual Studio 2022 for Mac version 17.3 17.3.5. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38013

Get alerted when CVE-2022-38013 or the next vulnerability affects your stack