CVE-2021-1721 json
.NET Core and Visual Studio Denial of Service Vulnerability
published 5y ago modified 2mo ago also BIT-dotnet-2021-1721 , BIT-dotnet-sdk-2021-1721 , EUVD-2022-2181 , GHSA-3gp9-h8hw-pxpw
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
.NET Core and Visual Studio Denial of Service Vulnerability
Patch / fix
- nuget Microsoft.NETCore.App 2.1.25
- nuget Microsoft.NETCore.App.Host.linux-arm 3.1.12
- nuget Microsoft.NETCore.App.Host.linux-arm64 3.1.12
- nuget Microsoft.NETCore.App.Host.linux-musl-arm64 3.1.12
- nuget Microsoft.NETCore.App.Host.linux-musl-x64 3.1.12
- nuget Microsoft.NETCore.App.Host.linux-x64 3.1.12
- nuget Microsoft.NETCore.App.Host.osx-x64 3.1.12
- nuget Microsoft.NETCore.App.Host.rhel.6-x64 3.1.12
- nuget Microsoft.NETCore.App.Host.win-arm 3.1.12
- nuget Microsoft.NETCore.App.Host.win-arm64 3.1.12
- nuget Microsoft.NETCore.App.Host.win-x64 3.1.12
- nuget Microsoft.NETCore.App.Host.win-x86 3.1.12
- nuget Microsoft.NETCore.App.Runtime.linux-arm 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-arm64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-musl-arm64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-musl-x64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.linux-x64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.osx-x64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.rhel.6-x64 3.1.12
- nuget Microsoft.NETCore.App.Runtime.win-arm 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.win-arm64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.win-x64 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.win-x86 3.1.12, 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 5.0.3
- nuget Microsoft.NETCore.App.Runtime.Mono.linux-arm 5.0.3
- dotnet5.0 RHEL 8 5.0.103-1.el8_3
- dotnet RHEL 8 5.0.103-1.el8_3
- dotnet-host RHEL 8 5.0.3-1.el8_3
- dotnet-sdk-5.0 RHEL 8 5.0.103-1.el8_3
- dotnet-hostfxr-5.0 RHEL 8 5.0.3-1.el8_3
- dotnet-runtime-5.0 RHEL 8 5.0.3-1.el8_3
- dotnet-templates-5.0 RHEL 8 5.0.103-1.el8_3
- aspnetcore-runtime-5.0 RHEL 8 5.0.3-1.el8_3
red hat advisories RHSA-2021:0476RHSA-2021:0473RHSA-2021:0474RHSA-2021:0472RHSA-2021:0470RHSA-2021:0471
- dotnet-sdk Arch Linux 5.0.3.sdk103-2
- dotnet-runtime Arch Linux 5.0.3.sdk103-2
arch linux advisories AVG-1449
Is CVE-2021-1721 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-1721 updated cvss 6.5
dotnet: certificate chain building recursion Denial of Service
-
Red Hat .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet21 2.1-24.el7_9, rh-dotnet21-runtime 2.1-24.el7_9, rh-dotnet21-dotnet 2.1.521-1.el7_9, rh-dotnet31-dotnet 3.1.112-1.el7_9, rh-dotnet50-dotnet 5.0.103-1.el7_9, rh-dotnet50-dotnet-host 5.0.3-1.el7_9, +23 more Red Hat .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet21 2.1-24.el7_9, rh-dotnet21-runtime 2.1-24.el7_9, rh-dotnet21-dotnet 2.1.521-1.el7_9, rh-dotnet31-dotnet 3.1.112-1.el7_9, rh-dotnet50-dotnet 5.0.103-1.el7_9, rh-dotnet50-dotnet-host 5.0.3-1.el7_9, +23 more Red Hat .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet21 2.1-24.el7_9, rh-dotnet21-runtime 2.1-24.el7_9, rh-dotnet21-dotnet 2.1.521-1.el7_9, rh-dotnet31-dotnet 3.1.112-1.el7_9, rh-dotnet50-dotnet 5.0.103-1.el7_9, rh-dotnet50-dotnet-host 5.0.3-1.el7_9, +23 morefixed: vendor fix RHSA-2021:0470
-
Red Hat Enterprise Linux AppStream (v. 8) dotnet 2.1.521-1.el8_3, dotnet 5.0.103-1.el8_3, dotnet-host 5.0.3-1.el8_3, dotnet3.1 3.1.112-1.el8_3, dotnet5.0 5.0.103-1.el8_3, dotnet-sdk-2.1 2.1.521-1.el8_3, +20 morefixed: vendor fix RHSA-2021:0471
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
3.34% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App | >=2.1.0, <2.1.25 |
2.1.25 |
| nuget | Microsoft.NETCore.App.Host.linux-arm | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-arm64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-musl-arm64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-musl-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.osx-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.rhel.6-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-arm | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-arm64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-x86 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.osx-x64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.rhel.6-x64 | >=3.1.0, <3.1.12 |
3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.win-x64 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.win-x86 | >=3.1.0, <3.1.12 >=5.0.0, <5.0.3 |
3.1.12 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-arm | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-arm64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.osx-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-arm | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-arm64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-x86 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.browser-wasm | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-arm | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-x86 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.tvos-arm64 | >=5.0.0, <5.0.3 |
5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.tvos-x64 | >=5.0.0, <5.0.3 |
5.0.3 |
| bitnami | dotnet | >=5.0.0, <5.0.3 |
5.0.3 |
| bitnami | dotnet-sdk | >=5.0.0, <5.0.3 |
5.0.3 |
Affected products
- Microsoft Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
- Microsoft PowerShell Core 7.1
- Microsoft PowerShell Core 7.0
- Microsoft .NET Core 2.1
- Microsoft .NET Core 3.1
- Microsoft .NET 5.0
- Microsoft Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
- Microsoft Microsoft Visual Studio 2019 version 16.8
- Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2021-1721
web, patch, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-1721
advisory, web
-
github.com
/dotnet/announcements/issues/175
web
-
github.com
/dotnet/runtime/issues/48067
web
Sources
- CVE List CVE-2021-1721
- GitHub Advisory GHSA-3gp9-h8hw-pxpw
- NVD CVE-2021-1721
- OSV BIT-dotnet-2021-1721
- OSV BIT-dotnet-sdk-2021-1721
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.