CVE-2021-26423

Name of the Vulnerable Software and Affected Versions .NET Core versions 2.1 through 3.1 .NET Core version 5.0 Visual Studio (affected versions not specified)

Description A denial of service issue exists due to insufficient input validation. This could allow a remote attacker to cause a denial of service. The issue is related to .NET (Core) server applications providing WebSocket endpoints, which could be tricked into endlessly looping while trying to read a single WebSocket frame.

Recommendations If you're using .NET 5.0, download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10). If you're using .NET Core 3.1, download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later). If you're using .NET Core 2.1, download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817.