CVE-2021-31957
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 5.14 % · percentile 92.47 % · scored 10 Nov 2026.
Observed 10 Nov 2026 20:24:10 UTC · Complete immutable risk JSON
EUVD-2021-2231PublishedWithdrawn
ASP.NET Core Denial of Service Vulnerability
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
cve-program · CVE-2021-31957
PublishedASP.NET Core Denial of Service Vulnerability
- Source published
- 8 Jun 2021 22:46:26 UTC
- Source modified
- 7 Oct 2026 16:12:06 UTC
- Observed here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
euvd · EUVD-2021-2231
PublishedASP.NET Core Denial of Service Vulnerability
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Jun 8, 2021, 10:46:26 PM
dateUpdated: Oct 7, 2026, 4:12:06 PM
4 related source bulletins · separate from aliases
RHSA-2021:2351: Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update
CVE-2021-31957
RHSA-2021:2350: Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update
CVE-2021-31957
RHSA-2021:2352: Red Hat Security Advisory: .NET Core 3.1 security and bugfix update
CVE-2021-31957
RHSA-2021:2353: Red Hat Security Advisory: .NET 5.0 security and bugfix update
CVE-2021-31957
- Source published
- Jun 8, 2021, 10:46:26 PM (timezone not stated)
- Source modified
- Oct 7, 2026, 4:12:06 PM (timezone not stated)
- Observed here
- 9 Nov 2026 22:11:02 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.
EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
nvd · CVE-2021-31957
PublishedASP.NET Core Denial of Service Vulnerability
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Modified
Weakness classifications: NVD-CWE-noinfo · CWE-400
Original publisher date fields
published: 2021-06-08T23:15:08.870
lastModified: 2026-10-07T17:16:42.677
6 source CPE criteria · context only
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_2019:8.10:*:*:*:*:macos:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
The original JSON retains the logical configuration operators, exclusions and version bounds.
- Source published
- 8 Jun 2021 23:15:08 UTC
- Source modified
- 7 Oct 2026 17:16:42 UTC
- Observed here
- 24 Oct 2026 18:17:28 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 · [email protected] · Primary · 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
osv · GHSA-mcwm-2wmc-6hv4
Withdrawn# Withdrawn This advisory was initially published and mapped incorrectly to nuget `Microsoft.NETCore.App.Ref`. We later reanalyzed this advisory and found it does not have a direct mapping to a NuGet package. Thus we have withdrawn this advisory. The underlying ASP.NET Core Denial of Service Vulnerability and CVE-2021-31957 remain legitimate. # Description. Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists when ASP.NET Core improperly handles client disconnect. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. ### Patches * If you're using .NET 5.0, you should download and install Runtime 5.0.7 or SDK 5.0.204 (for Visual Studio 2019 v16.8) or SDK 5.0.301 (for Visual Studio 2019 16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0. * If you're using .NET Core 3.1, you should download and install Runtime 3.1.16 or SDK 3.1.116 (for Visual Studio 2019 v16.4) or 3.1.410 (for Visual Studio 2019 v16.5 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1. #### Other Details - Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/188 - An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/33369 - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957
- Source published
- 6 Oct 2021 00:23:01 UTC
- Source modified
- 10 Sep 2026 03:49:16 UTC
- Observed here
- 23 Oct 2026 16:01:25 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Publisher rating · HIGH