Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2024-43483: 2.90% estimated exploitation activity in the next 30 days; percentile 86.95 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory may be exposed to a hostile input which may lead them to be susceptible to hash flooding attacks resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/327 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.8 or…

Published by the source

8 Oct 2024, 20:24 UTC

Last modified by the source

14 Oct 2024, 20:42 UTC

Source last checked

26 Oct 2026, 17:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-qj66-m88j-hmgj

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-43483

Advisory: Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability
IDs: CVE-2024-43483, GHSA-qj66-m88j-hmgj
Record: https://patchnext.com/advisories/cve-2024-43483 (revision 1, source checked 26 Oct 2026, 17:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: system.io.packaging 9.0.0-rc.2.24473.5, 8.0.1, 6.0.1; microsoft.extensions.caching.memory 9.0.0-rc.2.24473.5, 8.0.1, 6.0.2; system.security.cryptography.cose 9.0.0-rc.2.24473.5, 8.0.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet system.io.packaging: affected >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 6.0.0-preview.1.21102.12, <= 6.0.0; >= 8.0.0-preview.1.23110.8, <= 8.0.0; fixed in 8.0.1, 6.0.1, 9.0.0-rc.2.24473.5
- NuGet microsoft.extensions.caching.memory: affected >= 8.0.0-preview.1.23110.8, <= 8.0.0; >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 6.0.0-preview.1.21102.12, <= 6.0.1; fixed in 8.0.1, 9.0.0-rc.2.24473.5, 6.0.2
- NuGet system.security.cryptography.cose: affected >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 8.0.0-preview.1.23110.8, <= 8.0.0; fixed in 8.0.1, 9.0.0-rc.2.24473.5

## Suggested inspection (read-only)
- NuGet system.io.packaging: check the installed version with your package manager.
- NuGet microsoft.extensions.caching.memory: check the installed version with your package manager.
- NuGet system.security.cryptography.cose: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on system.io.packaging, microsoft.extensions.caching.memory, system.security.cryptography.cose.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-qj66-m88j-hmgj (GitHub-reviewed advisory GHSA-qj66-m88j-hmgj lists affected ranges: NuGet system.security.cryptography.cose >=9.0.0-preview.1.24080.9 =8.0.0-preview.1.23110.8 =9.0.0-preview.1.24080.9 =6.0.0-preview.1.21102.12 =8.0.0-preview.1.23110.8 =8.0.0-preview.1.23110.8 =9.0.0-preview.1.24080.9 =6.0.0-preview.1.21102.12 <=6.0.1)

Commands are suggestions: review each one before running it.