CVE-2024-43499: System.Formats.Nrbf Denial of Service Vulnerability in .NET 9.0
Summary
CVE-2024-43499: .NET Denial of Service Vulnerability. Affects System.Formats.Nrbf versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Also tracked for
- dotnet · Bitnami
- dotnet-sdk · Bitnami
The same CVE-2024-43499 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
System.Formats.Nrbf is a package within the .NET ecosystem that facilitates the encoding and decoding of data in the Nrbf format. This format is often utilized for serialization and deserialization of objects in .NET applications. The package is integral to applications that require efficient data transfer and storage. However, a vulnerability has been identified in version 9.0.0.RC.2 and earlier, which can lead to denial of service attacks if the component is improperly validated.
Vulnerability Detail
The vulnerability in the NrbfDecoder component of .NET 9.0 arises from inadequate input validation. This flaw allows attackers to exploit the component by sending specially crafted input that can cause the application to become unresponsive or crash. The potential ramifications include service downtime and disruption of application functionality, which can severely impact user experience and business operations. It is crucial for developers to understand the technical aspects of this vulnerability to mitigate risks effectively.
How To Fix
Latest published version: 10.0.13 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to avoid using the NrbfDecoder component in your applications. Applications that do not reference this component are not affected by the vulnerability. Additionally, consider implementing input validation checks to mitigate the risk of denial of service attacks until a proper fix can be applied.
Conclusion
The .NET Denial of Service Vulnerability (CVE-2024-43499) in the System.Formats.Nrbf package poses significant risks to applications using .NET 9.0. Developers are urged to update to the patched version to mitigate these risks. Understanding the vulnerability and its implications is crucial for maintaining application security.
See every vulnerability recorded for System.Formats.Nrbf →
FAQ
If your application uses .NET 9.0.0.RC.2 or earlier and references the System.Formats.Nrbf package, it is vulnerable. You can check your installed versions by running the 'dotnet --info' command.
The vulnerability can lead to denial of service, causing applications to crash or become unresponsive, which can disrupt services and affect user experience.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the packages.config file. You can check your application for vulnerabilities without needing to install any software.
If you cannot update the package right away, consider using a workaround by avoiding the use of the NrbfDecoder component and implementing additional input validation.
You can find more details in the Microsoft Security Advisory CVE-2024-43499 and on the GitHub announcements page.
Related vulnerabilities
Recent vulnerabilities recorded for System.Formats.Nrbf.
