Microsoft system.net.http vulnerabilities

Latest Microsoft system.net.http CVEs

Newest publication first

1. CVE-2017-0249 High severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   High·CVSS 7.3 EPSS 4.2%

   An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

2. CVE-2017-0256 Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   Medium·CVSS 5.3 EPSS 3.5%

   A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

3. CVE-2017-0247 ASP.NET Core fails to properly validate web requests

   Published 2017-05-12

   High·CVSS 7.5 EPSS 16.9%

   A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.