Vulnerability record · CVE-2013-3861 · published 9 October 2013
CVE-2013-3861: Microsoft .NET Framework JSON parsing denial of service
Microsoft · .Net Framework
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 fail to properly validate crafted character sequences in JSON data, causing an application crash or hang. The flaw is an input validation issue in JSON parsing that lets unauthenticated remote attackers degrade availability of .NET applications that process attacker-supplied JSON.
Description
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability."
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityRemote, unauthenticated availability impact across widely deployed .NET Framework versions, with very high EPSS despite no KEV listing.
What it is
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 fail to properly validate crafted character sequences in JSON data, causing an application crash or hang. The flaw is an input validation issue in JSON parsing that lets unauthenticated remote attackers degrade availability of .NET applications that process attacker-supplied JSON.
Impact
An attacker can crash or hang the affected .NET application, denying service to legitimate users. There is no confidentiality or integrity impact; only availability is affected.
Attack surface
Reachable over the network (AV:N) with no authentication (Au:N) and no user interaction, wherever an application passes untrusted JSON into the vulnerable .NET Framework parser. The record does not identify specific entry points beyond JSON data handling.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.82444, 99.6th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Apply Microsoft security bulletin MS13-082 for the affected .NET Framework versions.
- Validate and constrain JSON input size and character content before parsing in .NET applications.
- Isolate or rate-limit services that accept untrusted JSON to limit denial-of-service blast radius.
- Monitor for and restart hung or crashed .NET application processes as a stopgap where patching is delayed.
Detection
- Monitor .NET application logs for repeated unhandled exceptions or crashes tied to JSON parsing.
- Alert on process hangs or worker thread stalls in .NET services following inbound JSON requests.
- Watch for spikes in malformed or unusual character sequences in JSON payloads reaching .NET endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-3861 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-3861), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
