CVE-2024-21404: microsoft asp.net_core NULL Pointer Dereference

CVSS: 7.5v3.1HighModified

AliasesRHSA-2024:1552RHSA-2024:1553RHSA-2024:1554+4 more

Published 13-02-2024Last modified 10-08-2026

Vulnerability summary

CVE-2024-21404 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in microsoft asp.net_core. EPSS estimates a 2.71% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

2.71%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 1

RHSA-2024:0805 RHSA-2024:0806 RHSA-2024:0807 RHSA-2024:0808 RHSA-2024:0814 RHSA-2024:0827+4 more

Timeline

13-02-2024
PublishedVulnerability first disclosed.
10-08-2026
Last modifiedVulnerability information updated.

Description

.NET Denial of Service Vulnerability

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

2.71%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.71% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Redhat36 products

aspnetcore-runtime-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
aspnetcore-runtime-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
aspnetcore-targeting-pack-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
aspnetcore-targeting-pack-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet< 0:6.0.127-1.el8_6 | < 0:7.0.116-1.el8_8

dotnet-apphost-pack-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-apphost-pack-6.0-debuginfo< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-apphost-pack-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-apphost-pack-7.0-debuginfo< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-host< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_6 | < 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-host-debuginfo< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_6 | < 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-hostfxr-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-hostfxr-6.0-debuginfo< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-hostfxr-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-hostfxr-7.0-debuginfo< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-runtime-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-runtime-6.0-debuginfo< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-runtime-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-runtime-7.0-debuginfo< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-sdk-6.0< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet-sdk-6.0-debuginfo< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet-sdk-6.0-source-built-artifacts< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet-sdk-7.0< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet-sdk-7.0-debuginfo< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet-sdk-7.0-source-built-artifacts< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet-targeting-pack-6.0< 0:6.0.27-1.el9_0 | < 0:6.0.27-1.el8_8 | < 0:6.0.27-1.el8_6 | < 0:6.0.27-1.el9_2.1
dotnet-targeting-pack-7.0< 0:7.0.16-1.el8_8 | < 0:7.0.16-1.el9_2
dotnet-templates-6.0< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet-templates-7.0< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet6.0< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet6.0-debuginfo< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet6.0-debugsource< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_8 | < 0:6.0.127-1.el8_6 | < 0:6.0.127-1.el9_2.1
dotnet7.0< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet7.0-debuginfo< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
dotnet7.0-debugsource< 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2
netstandard-targeting-pack-2.1< 0:6.0.127-1.el9_0 | < 0:6.0.127-1.el8_6 | < 0:7.0.116-1.el8_8 | < 0:7.0.116-1.el9_2

Show all 36

Microsoft8 products

asp.net_core≥ 6.0.0, < 6.0.27 | ≥ 7.0.0, < 7.0.16 | ≥ 8.0.0, < 8.0.2
microsoft visual studio 2022 version 17.4≥ 17.4.0, < 17.4.16
microsoft visual studio 2022 version 17.6≥ 17.6.0, < 17.6.12
microsoft visual studio 2022 version 17.8≥ 17.8.0, < 17.8.7
.net 6.0≥ 6.0.0, < 6.0.27

Show all 8

Ubuntu3 products

dotnet6< 6.0.127-0ubuntu1~22.04.1
dotnet7< 7.0.116-0ubuntu1~22.04.1
dotnet8< 8.0.102-8.0.2-0ubuntu1~22.04.1

3 vendors · 47 products

References

21 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21404Vendor AdvisoryPatchREPORT
access.redhat.com/errata/RHSA-2024:1552Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2263086REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1552.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-21404REPORT
www.cve.org/CVERecord?id=CVE-2024-21404AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-21404Advisory
access.redhat.com/errata/RHSA-2024:1553Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1553.jsonAdvisory

Show all 21 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities