{"id":"CVE-2024-38095","state":"PUBLISHED","title":".NET and Visual Studio Denial of Service Vulnerability","description":".NET and Visual Studio Denial of Service Vulnerability","publishedAt":"2024-07-09T17:03:24.803Z","updatedAt":"2025-12-09T23:47:49.162Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft PowerShell 7.4","Microsoft PowerShell 7.2","Microsoft .NET 6.0","Microsoft .NET 8.0","Microsoft Microsoft Visual Studio 2022 version 17.4","Microsoft Microsoft Visual Studio 2022 version 17.6","Microsoft Microsoft Visual Studio 2022 version 17.8","Microsoft Microsoft Visual Studio 2022 version 17.10"],"affected":[{"vendor":"Microsoft","product":"PowerShell 7.4","versions":[{"version":"7.4.0","status":"affected","lessThan":"7.4.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[{"version":"7.2.0","status":"affected","lessThan":"7.2.22","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.32","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.17","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.12","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10","status":"affected","lessThan":"17.10.4","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38095"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/38xxx/CVE-2024-38095.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-38095","state":"PUBLISHED","datePublished":"2024-07-09T17:03:24.803Z","dateUpdated":"2025-12-09T23:47:49.162Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2024-06-11T22:36:08.184Z"},"containers":{"cna":{"title":".NET and Visual Studio Denial of Service Vulnerability","descriptions":[{"lang":"en-US","value":".NET and Visual Studio Denial of Service Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"PowerShell 7.4","versions":[{"version":"7.4.0","status":"affected","lessThan":"7.4.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[{"version":"7.2.0","status":"affected","lessThan":"7.2.22","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.32","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.17","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.12","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10","status":"affected","lessThan":"17.10.4","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38095","name":".NET and Visual Studio Denial of Service Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-12-09T23:47:49.162Z"},"datePublic":"2024-07-09T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*","versionStartIncluding":"7.4.0","versionEndExcluding":"7.4.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.22"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.32"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.4.0","versionEndExcluding":"17.4.21"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.6.0","versionEndExcluding":"17.6.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.8.0","versionEndExcluding":"17.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.10","versionEndExcluding":"17.10.4"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-09T20:02:27.324531Z","id":"CVE-2024-38095","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-09T20:02:36.933Z"}},{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38095","name":".NET and Visual Studio Denial of Service Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:04:25.264Z"}}]}}}