Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.extensions.caching.memory

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8NuGetPublished

    Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability

    CVE-2024-43483 · GHSA-qj66-m88j-hmgj

    Affected
    • NuGet microsoft.extensions.caching.memory >= 8.0.0-preview.1.23110.8, <= 8.0.0; >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 6.0.0-preview.1.21102.12, <= 6.0.1
    Fixed in
    8.0.19.0.0-rc.2.24473.56.0.2· Vendor fix available
    Issue
    Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory may be exposed to a hostile input which may lead them to be susceptible to hash flooding attacks resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/327 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.8 or…

    Recommended action: Upgrade to 9.0.0-rc.2.24473.5 (pre-release), 8.0.1 or 6.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →