CVE-2024-43484: microsoft microsoft .net framework 2.0 service pack 2 Inefficient Algorithmic Complexity
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2024-43484GHSA-f32c-w444-8ppvBIT-dotnet-2024-43484BIT-dotnet-sdk-2024-43484
Published 08-10-2024Last modified 19-08-2026
Vulnerability summary
CVE-2024-43484 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in microsoft microsoft .net framework 2.0 service pack 2. EPSS estimates a 2.96% chance of exploitation in the next 30 days, higher than 87% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
2.96%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 1Timeline
- 08-10-2024PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.8Preferred score · OSV · Nuget (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.96%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
+0.02 pp
From 2.94% on 19-09-2026
19-09-202619-10-2026
EPSS score2.96%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected systems
Microsoft22 products
- microsoft .net framework 2.0 service pack 2≥ 2.0.0, < 3.0.30729.8974
- microsoft .net framework 3.0 service pack 2≥ 3.0.0, < 3.0.30729.8974
- microsoft .net framework 3.5≥ 3.5.0, < 3.5.30729.8973
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 4.7.04115.01
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 4.8.04762.01
Ubuntu3 products
- dotnet6< 6.0.135-0ubuntu1~22.04.1
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.110-8.0.10-0ubuntu1~22.04.1 | < 8.0.110-8.0.10-0ubuntu1~24.04.1
NuGet1 product
- System.IO.Packaging≥ 9.0.0-preview.1.24080.9, < 9.0.0-rc.2.24473.5 | ≥ 8.0.0-preview.1.23110.8, < 8.0.1 | ≥ 6.0.0-preview.1.21102.12, < 6.0.1
3 vendors · 26 products
References
12 links
Show all 12 references
- github.com/dotnet/runtimePACKAGE