Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.identitymodel.jsonwebtokens

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8NuGetPublished

    Microsoft ASP.NET Core project templates vulnerable to denial of service

    CVE-2024-21319 · GHSA-59j7-ghrg-fj52

    Affected
    • NuGet microsoft.identitymodel.jsonwebtokens < 5.7.0; >= 6.5.0, < 6.34.0; >= 7.0.0-preview, < 7.1.2
    Fixed in
    6.34.07.1.25.7.0· Vendor fix available
    Issue
    A Denial of Service vulnerability exists in ASP.NET Core project templates which utilize JWT-based authentication tokens. This vulnerability allows an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/290 Mitigation factors This impacts only .NET Core-based projects that were created using any version of project templates listed in affected software. Other project templates e.g., console applications, MAUI applications, Windows Forms or WPF applications, are not affected. Affected software This impacts only .NET Core-based projects that were created using any version of the below project templates. - ASP.NET Core Web App (Model-View-Controller) - ASP.NET Core Web API - ASP.NET Core Web App (Razor Pages) - Blazor Server…

    Recommended action: Upgrade to 7.1.2, 6.34.0 or 5.7.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →