Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability
Date: 2024-10
Affected: nuget/System.Text.Json, nuget/System.Text.Json
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-43485
CWE: CWE-407
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

# Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Text.Json 6.0.x and 8.0.x. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. In System.Text.Json 6.0.x and 8.0.x, applications which deserialize input to a model with an `[JsonExtensionData]` property can be vulnerable to an algorithmic complexity attack resulting in Denial of Service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/329 ## <a name="mitigation-factors"></a>Mitigation factors JSON models which do not utilize the `[JsonExtensionData]` feature are not impacted by this vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 8.0 application running on .NET 8.0.8 or earlier. * Any .NET 6.0 aplication running on .NET 6.0.33 or earlier. * Any application consuming one of the [vulnerable packages](affected-packages). ## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below ### <a name=".NET 8"></a>.NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Text.Json](https://www.nuget.org/packages/S


Mitigations:

Architectural layers (MAESTRO):