← Vulnerability feed

Vulnerability record · CVE-2005-2224 · published 12 July 2005

CVE-2005-2224: Microsoft asp.net vulnerability

Microsoft · Asp.Net

aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.

5.0 CVSS 2.0 Medium EPSS 18% · top 2.9% CWE-835 · CWE-835
5.0CVSS 2.0 base score
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/16005 Not ApplicableVendor Advisory
http://www.securityfocus.com/bid/14217 Third Party AdvisoryVDB Entry
http://www.spidynamics.com/spilabs/advisories/aspRCP.html Broken LinkExploitVendor Advisory
http://secunia.com/advisories/16005 Not ApplicableVendor Advisory
http://www.securityfocus.com/bid/14217 Third Party AdvisoryVDB Entry
http://www.spidynamics.com/spilabs/advisories/aspRCP.html Broken LinkExploitVendor Advisory

Track CVE-2005-2224 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2004-0847ASP.NET forms authentication bypass via backslash path traversalASP.NET forms authentication can be bypassed for .aspx files in restricted directories by sending a request containing a backslash or its encoded for…EPSS 76%analysed7.5CVE-2006-1364Microsoft ASP.NET w3wp COM component handling denial of serviceMicrosoft w3wp.exe mishandles requests for ASP.NET documents that reference COM components without the AspCompat directive, leading to uncontrolled r…EPSS 59%analysed6.8CVE-2003-0768Microsoft asp.net vulnerabilityMicrosoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character i…EPSS 13%6.4CVE-2005-1664Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one …EPSS 19%5.0CVE-2005-1665Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU …EPSS 40%4.3CVE-2010-2084Microsoft asp.net cross-site scripting vulnerabilityMicrosoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attac…EPSS 13%4.3CVE-2010-2088Microsoft asp.net cross-site scripting vulnerabilityASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS)…EPSS 9.0%4.3CVE-2005-0452Microsoft asp.net vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or…EPSS 23%

Source: NIST National Vulnerability Database (record CVE-2005-2224), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.