Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected: NuGet: Microsoft.AspNetCore.WebUtilities

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

FileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/512

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-770

## Affected Platforms

- **Platforms:** Any supported OS - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages

The table lists the affected package range and the fixed NuGet version.

### ASP.NET Core 2.3 - standalone packages

Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 2.3.0, <= 2.3.13 | 2.3.14

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?

Check the application's Microsoft.AspNetCore.WebUtilities package reference against the affected range above, including transitive dependencies brought in by Microsoft.AspNetCore.Http. Use `dotnet list <PROJECT> package --include-transitive` to inspect resolved dependencies.

### <a name="how-fix"></a>How do I fix the issue?

Update each appl…