CVE-2022-23267

Name of the Vulnerable Software and Affected Versions .NET Core versions 3.1 through 3.1.24 .NET 5.0 versions 5.0 through 5.0.16 .NET 6.0 versions 6.0 through 6.0.4

Description The issue is related to incorrect cleanup or release of resources in Microsoft Visual Studio and the .NET Framework, which can lead to a denial of service. A malicious client can cause this via excess memory allocations through the HttpClient.

Recommendations For .NET Core 3.1, update to Runtime 3.1.25 or SDK 3.1.419. For .NET 5.0, update to Runtime 5.0.17 or SDK 5.0.214. For .NET 6.0, update to Runtime 6.0.5 or SDK 6.0.105. As a temporary workaround, consider restricting the use of HttpClient to minimize the risk of exploitation.