vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-0247

N/A
Published: May 12, 2017 at 02:00 PM UTC
Updated: June 17, 2026 at 12:57 AM UTC
19 products affected across 1 vendorAsp.net Model View ControllerSystem.net.http.winhttphandlerMicrosoft.aspnetcore.mvc.taghelpers

Using ASP.NET Core by Microsoft Corporation?

Get instant alerts when new vulnerabilities affect ASP.NET Core - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 17%

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_MISCTechnical DescriptionThird Party Advisory
Source: [email protected]
https://github.com/aspnet/Announcements/issues/239
x_refsource_CONFIRMPatchVendor Advisory
Source: [email protected]
https://technet.microsoft.com/en-us/library/security/4021279.aspx
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS

CVSS

5MEDIUM[email protected]
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card