PatchTheCVECVE-2023-38180: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
85
Patch now
HIGH 7.5EXPLOITEDREMOTEWATCHLISTUPGRADEUPGRADEUPGRADE
CVE-2023-38180 is a high-severity flaw (CVSS 7.5) affecting .net, asp.net core, visual studio 2022, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
.NET and Visual Studio Denial of Service Vulnerability
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 14.1% (top 3%) |
| CISA exploited list | Yes, fix due 2023-08-30 |
| Weakness | CWE-400 |
| Published | 2023-08-08 |
| Last modified | 2026-08-10 |
Last updated 2026-08-10 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
microsoft .net UPGRADE
Affected: >= 6.0.0 and < 6.0.21 · >= 7.0.0 and < 7.0.10
Fixed in: 6.0.21, 7.0.10
Safe to downgrade to: a release before 6.0.0
1. Check installed version
apt-cache policy .net || rpm -q .net || .net --version
2. UPGRADE to 6.0.21 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade .net
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade .net
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.0.0 (Debian / Ubuntu)
apt-cache madison .net
sudo apt install .net=<VERSION_BEFORE_6.0.0>
sudo apt-mark hold .net
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list .net
sudo dnf downgrade .net-<VERSION_BEFORE_6.0.0>
sudo dnf versionlock add .net
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft asp.net core UPGRADE
Affected: >= 2.1 and < 2.1.40
Fixed in: 2.1.40
Safe to downgrade to: a release before 2.1
1. Check installed version
apt-cache policy asp.net-core || rpm -q asp.net-core || asp.net-core --version
2. UPGRADE to 2.1.40 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade asp.net-core
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade asp.net-core
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.1 (Debian / Ubuntu)
apt-cache madison asp.net-core
sudo apt install asp.net-core=<VERSION_BEFORE_2.1>
sudo apt-mark hold asp.net-core
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list asp.net-core
sudo dnf downgrade asp.net-core-<VERSION_BEFORE_2.1>
sudo dnf versionlock add asp.net-core
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft visual studio 2022 UPGRADE
Affected: >= 17.2.0 and < 17.2.18 · >= 17.4.0 and < 17.4.10 · >= 17.6.0 and < 17.6.6
Fixed in: 17.2.18, 17.4.10, 17.6.6
Safe to downgrade to: a release before 17.2.0
1. Check installed version
apt-cache policy visual-studio-2022 || rpm -q visual-studio-2022 || visual-studio-2022 --version
2. UPGRADE to 17.2.18 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade visual-studio-2022
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade visual-studio-2022
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 17.2.0 (Debian / Ubuntu)
apt-cache madison visual-studio-2022
sudo apt install visual-studio-2022=<VERSION_BEFORE_17.2.0>
sudo apt-mark hold visual-studio-2022
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list visual-studio-2022
sudo dnf downgrade visual-studio-2022-<VERSION_BEFORE_17.2.0>
sudo dnf versionlock add visual-studio-2022
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
fedoraproject fedora MITIGATE
Affected: 37 · 38
Fixed in: no fixed release known
Safe to downgrade to: a release before 37
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.win-arm64 · FIXED · 7.0.10 · vulnerable: >= 7.0.0, <= 7.0.9 · source
dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 7.0.10
NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.win-x64 · FIXED · 7.0.10 · vulnerable: >= 7.0.0, <= 7.0.9 · source
dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 7.0.10
NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.win-x86 · FIXED · 7.0.10 · vulnerable: >= 7.0.0, <= 7.0.9 · source
dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 7.0.10
NuGet (.NET) · Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv · FIXED · 6.0.21 · vulnerable: >= 6.0.0, <= 6.0.20 · source
dotnet add package Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv --version 6.0.21
Fedora 46 · borgmatic · FIXED · 2.2.0-1.fc46 · FEDORA-2026-041229e71b · source
sudo dnf upgrade --advisory=FEDORA-2026-041229e71b
Fedora ELN · pie · FIXED · 1.5.4-1.eln159 · FEDORA-2026-a2c0261d3a · source
sudo dnf upgrade --advisory=FEDORA-2026-a2c0261d3a
Ubuntu 22.04 · dotnet6 · FIXED · 6.0.121-0ubuntu1~22.04.1
sudo apt update && sudo apt install --only-upgrade dotnet6
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet6)" ge "6.0.121-0ubuntu1~22.04.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · dotnet7 · FIXED · 7.0.110-0ubuntu1~22.04.1
sudo apt update && sudo apt install --only-upgrade dotnet7
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet7)" ge "7.0.110-0ubuntu1~22.04.1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 8 · dotnet7.0 · FIXED · dotnet7.0-7.0.110-1.el8_8
sudo dnf upgrade --advisory=RHSA-2023:4643
rpm -q dotnet7.0
RHEL 8 · dotnet6.0 · FIXED · dotnet6.0-6.0.121-1.el8_8
sudo dnf upgrade --advisory=RHSA-2023:4645
rpm -q dotnet6.0
RHEL 8.6 Extended Update Support · dotnet6.0 · FIXED · dotnet6.0-6.0.121-1.el8_6
sudo dnf upgrade --advisory=RHSA-2023:4640
rpm -q dotnet6.0
RHEL 9 · dotnet7.0 · FIXED · dotnet7.0-7.0.110-1.el9_2
sudo dnf upgrade --advisory=RHSA-2023:4642
rpm -q dotnet7.0
RHEL 9 · dotnet6.0 · FIXED · dotnet6.0-6.0.121-1.el9_2
sudo dnf upgrade --advisory=RHSA-2023:4644
rpm -q dotnet6.0
Alpine 3.20 · dotnet6-build · FIXED · dotnet6-build-6.0.121-r0
apk add --upgrade dotnet6-build
apk info -v dotnet6-build
Alpine 3.20 · dotnet6-runtime · FIXED · dotnet6-runtime-6.0.21-r0
apk add --upgrade dotnet6-runtime
apk info -v dotnet6-runtime
sudo dnf update --advisory=ALAS2023-2023-326
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-38180?
.net: upgrade to 6.0.21, 7.0.10; asp.net core: upgrade to 2.1.40; visual studio 2022: upgrade to 17.2.18, 17.4.10, 17.6.6. Exact commands for each OS are on this page.
Is CVE-2023-38180 being exploited?
Yes. CVE-2023-38180 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2023-38180 affect?
CVE-2023-38180 affects .net, asp.net core, visual studio 2022. Severity is high (CVSS 7.5). .NET and Visual Studio Denial of Service Vulnerability
How urgent is CVE-2023-38180?
Priority 85/100. High severity; EPSS top 3%: very likely to be exploited; Exploited in the wild (CISA KEV); Remotely exploitable, no login, no user action; On your watchlist
Software pages
.NET vulnerabilities · Visual Studio vulnerabilities
Related CVEs
- CVE-2026-111497 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-70354 HIGH 7.8 UPGRADE UPGRADE Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
- CVE-2026-62898 HIGH 7.5 UPGRADE UPGRADE Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
- CVE-2026-62886 HIGH 7.8 UPGRADE UPGRADE Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-62871 HIGH 7.8 UPGRADE UPGRADE Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.