CVE-2023-38180: Microsoft .NET and Visual Studio uncontrolled resource consumption DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network, unauthenticated reachability plus CISA KEV listing and a high EPSS percentile make this an urgent availability threat despite thin technical detail.

What it is

CVE-2023-38180 is a denial-of-service flaw in Microsoft .NET, ASP.NET Core and Visual Studio 2022, classified as uncontrolled resource consumption (CWE-400). The record gives no technical detail on the specific mechanism, but the network-reachable, unauthenticated nature makes it a practical availability risk for exposed services.

Impact

An attacker can degrade or exhaust resources, causing denial of service on affected .NET or ASP.NET Core workloads. No confidentiality or integrity impact is indicated by the CVSS vector.

Attack surface

Reachable over the network per the CVSS vector (AV:N) with no privileges (PR:N) and no user interaction (UI:N). Any internet- or network-exposed .NET/ASP.NET Core endpoint built on an unpatched runtime is in scope.

Exploitation

It is listed in CISA KEV with a 2023-08-30 remediation due date, indicating known exploitation, and EPSS is 0.14016 (96th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft MSRC updates for .NET, ASP.NET Core and Visual Studio 2022 immediately, per the vendor advisory.
• Update Fedora packages using the referenced package-announce advisories.
• If patching cannot be completed by the KEV due date, restrict network exposure of affected .NET/ASP.NET Core services or discontinue use as CISA directs.
• Add rate limiting and resource caps in front of exposed .NET endpoints to blunt resource-exhaustion attempts.
• Track KEV remediation deadlines and verify patched runtime versions across all deployments.

Detection

• Monitor .NET/ASP.NET Core hosts for abnormal CPU, memory or thread-pool exhaustion and request-rate spikes.
• Alert on sudden latency increases or 5xx/timeout surges from .NET services.
• Review process and connection counts on .NET application servers for sustained anomalies.
• Correlate spikes with inbound request patterns to identify deliberate resource-exhaustion traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.