Skip to main content

Visual Studio 2022 CVE-2024-21386

HIGH
Uncontrolled Resource Consumption (CWE-400)
N/A vendor:alpine
Denial Of Service Microsoft Visual Studio 2022 Asp Net Core
7.5
CVSS 3.1 · Vendor: vendor:alpine
View

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 2.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

Alpine Linux: dotnet8-runtime fixed in 8.0.2-r0

Affected Packages

nuget microsoft.aspnetcore.app.runtime.linux-arm fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.linux-arm64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.linux-musl-arm fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.linux-musl-arm64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.linux-musl-x64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.linux-x64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.osx-arm64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.osx-x64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.win-arm fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.win-arm64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.win-x64 fix: 6.0.27, 7.0.16, 8.0.2
nuget microsoft.aspnetcore.app.runtime.win-x86 fix: 6.0.27, 7.0.16, 8.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 12 packages in nuget

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Visual Studio 2022 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:alpine) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vendor:alpine) · only source for this CVE.

CVSS VectorVendor: vendor:alpine

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
CVSS changed
Aug 10, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
May 27, 2026 - 22:55 nvd
MEDIUM

Threat Intelligence Overview

EPSS Score
2.4%
Top 15% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 2.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: +2
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*

More in Visual Studio 2022

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2025-26682 HIGH
7.5 Apr 08

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
CVE-2025-55315 CRITICAL POC
9.9

ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchro
CVE-2026-69439 HIGH POC
8.8 Sep 08

Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
CVE-2026-71328 HIGH POC
8.8 Sep 08

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
PATCH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21386

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy