CVE-2017-0247

Published: May 12, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Affected (101)

Microsoft

18 products

Asp.net Model View Controller

Microsoft.aspnetcore.mvc.abstractions

Microsoft.aspnetcore.mvc.apiexplorer

Microsoft.aspnetcore.mvc.cors

Microsoft.aspnetcore.mvc.dataannotations

Microsoft.aspnetcore.mvc.formatters.json

Microsoft.aspnetcore.mvc.formatters.xml

Microsoft.aspnetcore.mvc.localization

Microsoft.aspnetcore.mvc.razor

Microsoft.aspnetcore.mvc.razor.host

Microsoft.aspnetcore.mvc.taghelpers

Microsoft.aspnetcore.mvc.viewfeatures

Microsoft.aspnetcore.mvc.webapicompatshim

System.net.http

System.net.http.winhttphandler

System.net.security

System.net.websockets.client

System.text.encodings.web

Configuration A

101 vulnerable

Vulnerable Software	Affected Versions
Microsoft Asp.net Model View Controller	Version 1.0.0
Microsoft Asp.net Model View Controller	Version 1.0.1
Microsoft Asp.net Model View Controller	Version 1.0.2
Microsoft Asp.net Model View Controller	Version 1.0.3
Microsoft Asp.net Model View Controller	Version 1.1.0
Microsoft Asp.net Model View Controller	Version 1.1.1
Microsoft Asp.net Model View Controller	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.abstractions	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.apiexplorer	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.cors	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.dataannotations	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.formatters.json	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.formatters.xml	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.localization	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.razor	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.razor.host	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.taghelpers	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.viewfeatures	Version 1.1.2
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.0.0
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.0.1
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.0.2
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.0.3
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.1.0
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.1.1
Microsoft Microsoft.aspnetcore.mvc.webapicompatshim	Version 1.1.2
Microsoft System.net.http	Version 4.1.1
Microsoft System.net.http	Version 4.3.1
Microsoft System.net.http.winhttphandler	Version 4.0.1
Microsoft System.net.http.winhttphandler	Version 4.3.0
Microsoft System.net.security	Version 4.0.0
Microsoft System.net.security	Version 4.3.0
Microsoft System.net.websockets.client	Version 4.0.0
Microsoft System.net.websockets.client	Version 4.3.0
Microsoft System.text.encodings.web	Version 4.0.0
Microsoft System.text.encodings.web	Version 4.3.0