CVE-2023-36799: microsoft microsoft visual studio 2022 version 17.2 Uncontrolled Resource Consumption

CVSS: 6.5v3.1MediumModified

AliasesRHSA-2023:5142RHSA-2023:5143RHSA-2023:5144+13 more

Published 12-09-2023Last modified 30-10-2025

Vulnerability summary

CVE-2023-36799 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in microsoft microsoft visual studio 2022 version 17.2. EPSS estimates a 4.91% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

4.91%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2

USN-6438-1 USN-6438-2

Timeline

12-09-2023
PublishedVulnerability first disclosed.
30-10-2025
Last modifiedVulnerability information updated.

Description

.NET Core and Visual Studio Denial of Service Vulnerability

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

4.91%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.91% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Redhat49 products

aspnetcore-runtime-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
aspnetcore-runtime-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
aspnetcore-targeting-pack-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
aspnetcore-targeting-pack-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet< 0:7.0.111-1.el8_8 | < 0:7.0.113-1.el8_8

dotnet-apphost-pack-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-apphost-pack-6.0-debuginfo< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-apphost-pack-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-apphost-pack-7.0-debuginfo< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-host< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-host-debuginfo< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-hostfxr-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-hostfxr-6.0-debuginfo< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-hostfxr-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-hostfxr-7.0-debuginfo< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-runtime-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-runtime-6.0-debuginfo< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-runtime-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-runtime-7.0-debuginfo< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-sdk-6.0< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet-sdk-6.0-debuginfo< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet-sdk-6.0-source-built-artifacts< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet-sdk-7.0< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet-sdk-7.0-debuginfo< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet-sdk-7.0-source-built-artifacts< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet-targeting-pack-6.0< 0:6.0.22-1.el9_2 | < 0:6.0.22-1.el8_8 | < 0:6.0.24-1.el9_2 | < 0:6.0.24-1.el8_8
dotnet-targeting-pack-7.0< 0:7.0.11-1.el8_8 | < 0:7.0.11-1.el9_2 | < 0:7.0.13-1.el9_2 | < 0:7.0.13-1.el8_8
dotnet-templates-6.0< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet-templates-7.0< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet6.0< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet6.0-debuginfo< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet6.0-debugsource< 0:6.0.122-1.el9_2 | < 0:6.0.122-1.el8_8 | < 0:6.0.124-1.el9_2 | < 0:6.0.124-1.el8_8
dotnet7.0< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet7.0-debuginfo< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
dotnet7.0-debugsource< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
netstandard-targeting-pack-2.1< 0:7.0.111-1.el8_8 | < 0:7.0.111-1.el9_2 | < 0:7.0.113-1.el9_2 | < 0:7.0.113-1.el8_8
rh-dotnet60-aspnetcore-runtime-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-aspnetcore-targeting-pack-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9
rh-dotnet60-dotnet-apphost-pack-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet-debuginfo< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9
rh-dotnet60-dotnet-host< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet-hostfxr-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet-runtime-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet-sdk-6.0< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9
rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9
rh-dotnet60-dotnet-targeting-pack-6.0< 0:6.0.22-1.el7_9 | < 0:6.0.24-1.el7_9
rh-dotnet60-dotnet-templates-6.0< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9
rh-dotnet60-netstandard-targeting-pack-2.1< 0:6.0.122-1.el7_9 | < 0:6.0.124-1.el7_9

Show all 49

Microsoft10 products

microsoft visual studio 2022 version 17.2≥ 17.2.0, < 17.2.21
microsoft visual studio 2022 version 17.4≥ 17.4.0, < 17.4.13
microsoft visual studio 2022 version 17.6≥ 17.6.0, < 17.6.9
microsoft visual studio 2022 version 17.7≥ 17.7.0, < 17.6.9
.netEOL6.0.0 | 7.0.0

Show all 10

NuGet6 products

Microsoft.NETCore.App.Runtime.linux-arm≥ 7.0.0, < 7.0.11 | ≥ 6.0.0, < 6.0.22
Microsoft.NETCore.App.Runtime.linux-arm64≥ 7.0.0, < 7.0.11 | ≥ 6.0.0, < 6.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm≥ 7.0.0, < 7.0.11 | ≥ 6.0.0, < 6.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm64≥ 7.0.0, < 7.0.11 | ≥ 6.0.0, < 6.0.22
Microsoft.NETCore.App.Runtime.linux-musl-x64≥ 7.0.0, < 7.0.11 | ≥ 6.0.0, < 6.0.22

Show all 6

Ubuntu2 products

dotnet6< 6.0.122-0ubuntu1~22.04.1 | < 6.0.124-0ubuntu1~22.04.1
dotnet7< 7.0.111-0ubuntu1~22.04.1 | < 7.0.113-0ubuntu1~22.04.1

4 vendors · 67 products

References

38 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799Vendor AdvisoryWEBPatch
access.redhat.com/errata/RHSA-2023:5142AdvisoryARTICLE
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2237317REPORT
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5142.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-36799REPORT
www.cve.org/CVERecord?id=CVE-2023-36799AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-36799Advisory
devblogs.microsoft.com/dotnet/september-2023-updates/ARTICLEREPORT
access.redhat.com/errata/RHSA-2023:5143AdvisoryARTICLE

Show all 38 references

security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5143.jsonAdvisory
access.redhat.com/errata/RHSA-2023:5144AdvisoryARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5144.jsonAdvisory
access.redhat.com/errata/RHSA-2023:5145AdvisoryARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5145.jsonAdvisory
access.redhat.com/errata/RHSA-2023:5146AdvisoryARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5146.jsonAdvisory
access.redhat.com/errata/RHSA-2023:6242Advisory
support.microsoft.com/en-gb/…ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6242.jsonAdvisory
access.redhat.com/errata/RHSA-2023:6245Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6245.jsonAdvisory
access.redhat.com/errata/RHSA-2023:6246Advisory
support.microsoft.com/en-gb/…ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6246.jsonAdvisory
access.redhat.com/errata/RHSA-2023:6247Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6247.jsonAdvisory
access.redhat.com/errata/RHSA-2023:6249Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6249.jsonAdvisory
ubuntu.com/security/CVE-2023-36799REPORT
ubuntu.com/security/notices/USN-6362-1Advisory
ubuntu.com/security/notices/USN-6438-1Advisory
ubuntu.com/security/notices/USN-6438-2Advisory
ubuntu.com/security/notices/USN-6362-2Advisory
launchpad.net/bugs/2040207REPORT
launchpad.net/bugs/2040208REPORT
github.com/dotnet/runtime/security/advisories/GHSA-h3hv-63q5-jgprWEB
github.com/dotnet/runtimePACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities