CVE-2023-38180
dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 8, 2023
Updated · November 22, 2025
Description
An uncontrolled resource consumption vulnerability was found in the Kestrel component of the dotNET. When detecting a potentially malicious client, Kestrel will sometimes fail to disconnect it, resulting in denial of service.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
If your application is running behind a reverse proxy, or Web Application Firewall, which has its own mitigations against HTTP based attacks this issue may be mitigated by the proxy or WAF.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 · Uncontrolled Resource Consumption