Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Microsoft.AspNetCore.App.Runtime packages for .NET 8.0 before 8.0.10 and for 9.0 preview builds before 9.0.0-rc.2.24474.3 are affected, including the linux, osx, and win runtime variants. A use-after-free caused by a race condition occurs when an HTTP/3 stream is closed while application code is writing to the response body, and the source does not describe what an attacker can achieve beyond remote code execution. HTTP/3 is not enabled by default. Upgrade to 8.0.10 or 9.0.0-rc.2.24474.3.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C | CNA (microsoft) |
- CISA KEV Not listed.
- EPSS 0.021, the 81st percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 8 Oct 2024, 17:23 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 15:22 UTC First seen by agentprime
- 31 Oct 2026, 15:22 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-7vw9-cfwx-9gx9
- OSV: GHSA-7vw9-cfwx-9gx9
- github.com/dotnet/aspnetcore/security/advisories/GHSA-7vw9-cfwx-9gx9
- nvd.nist.gov/vuln/detail/CVE-2024-38229
- github.com/dotnet/announcements/issues/326
- github.com/dotnet/aspnetcore/issues/58297
- github.com/dotnet/aspnetcore
- learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/endpoints?view=aspnetcore-8.0#configure-http-protocols-in-appsettingsjson
- learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/http3?view=aspnetcore-8.0#getting-started
- msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38229
- www.herodevs.com/vulnerability-directory/cve-2024-38229