CVE-2024-43485: System.Text.Json Denial of Service Vulnerability
Summary
CVE-2024-43485: Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability. Affects System.Text.Json across 2 version ranges.
>= 6.0.0, < 6.0.10
>= 8.0.0, < 8.0.5
Fixed in 6.0.10 or 8.0.5, depending on the release line you run. How to fix ↓
Also tracked for
- dotnet · Bitnami
- dotnet-sdk · Bitnami
The same CVE-2024-43485 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
System.Text.Json is a high-performance JSON serialization and deserialization library for .NET applications. It is widely used for converting .NET objects to JSON and vice versa, providing developers with a simple and efficient way to handle JSON data. However, versions 6.0.x and 8.0.x of this package are vulnerable to an algorithmic complexity attack when deserializing input to models with an [ExtensionData] property, which can lead to Denial of Service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from the way System.Text.Json handles deserialization of JSON data into objects with an [ExtensionData] property. Attackers can exploit this by sending specially crafted JSON input that causes excessive resource consumption during deserialization, leading to application crashes or unresponsiveness. This vulnerability is classified under CWE-407, indicating a potential denial of service due to resource exhaustion. The severity of this issue is highlighted by a CVSS score of 7.5, indicating a high risk to applications using the affected versions of the package.
How To Fix
Latest published version: 10.0.13 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.106.0.10 -
>= 8.0.0, < 8.0.58.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot update the package immediately, consider avoiding the use of the [ExtensionData] feature in your JSON models, as this will mitigate the risk associated with this vulnerability.
Conclusion
CVE-2024-43485 is a significant vulnerability affecting the System.Text.Json library in .NET applications, leading to potential Denial of Service attacks. It is crucial for developers to update to the patched versions of the library to safeguard their applications. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for System.Text.Json →
FAQ
If you are using System.Text.Json versions 6.0.33 or earlier for .NET 6.0, or versions 8.0.8 or earlier for .NET 8.0, your application is vulnerable.
Exploiting this vulnerability can lead to Denial of Service, causing your application to crash or become unresponsive.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
As a temporary measure, avoid using the [ExtensionData] feature in your JSON models to reduce the risk of exploitation.
You can find detailed information in the Microsoft Security Advisory for CVE-2024-43485 and on the CVE website.
References
Related vulnerabilities
Recent vulnerabilities recorded for System.Text.Json.
