Skip to content
Fencer Intel
high 7.5

CVE-2018-8409 json

Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests

published 2018-09-13 8 y ago modified 2026-06-17 4 mo ago also GHSA-j378-6mmw-hqfr , EUVD-2018-0622

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.6%
EPSS 6.6% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.

Patch / fix

  • nuget Microsoft.AspNetCore.All 2.1.4
  • nuget Microsoft.AspNetCore.App 2.1.4
  • nuget System.IO.Pipelines 4.5.1
  • microsoft .net_core 2.1.4
  • microsoft asp.net_core 2.1.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-8409 updated cvss 5.1

NET: Resource loop in ReadAsync when it is being cancelled while producer allocates memory using GetMemory

  • Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-dotnetcore Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-dotnetcore Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-dotnet Red Hat .NET Core 2.1 on Red Hat Enterprise Linux rh-dotnet21-dotnet, rh-dotnet21-dotnet-host, rh-dotnet21-dotnet-sdk-2.1, rh-dotnet21-dotnet-runtime-2.1, rh-dotnet21-dotnet-sdk-2.1.3xx, rh-dotnet21-dotnet-sdk-2.1.4xx, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.56% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
nuget Microsoft.AspNetCore.All
>=2.1.0, <2.1.4
2.1.4
nuget Microsoft.AspNetCore.App
>=2.1.0, <2.1.4
2.1.4
nuget System.IO.Pipelines
>=4.5.0, <4.5.1
4.5.1

Affected products

  • Microsoft System.IO.Pipelines
  • Microsoft .NET Core
  • Microsoft ASP.NET Core

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.