CVE-2022-26924 — Vulnerability in Yarp.ReverseProxy — CVE Details
HIGH
YARP Denial of Service Vulnerability
Published April 22, 2022Updated December 5, 2024Source: osv
Summary
### Impact
A denial of service vulnerability exists in how YARP processes input.
### Patches
If you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).
If you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).
You can do so by updating the `PackageReference` in your `.csproj` file
```diff
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="1.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="1.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.1" />
</ItemGroup>
```
or by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)
### References
[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)
Advisory Timeline
- First published April 22, 2022 (1634 days ago).
- Last revised December 5, 2024 — 957 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Yarp.ReverseProxy to 1.1.0-rc.1.22211.2 or laterdotnet add package Yarp.ReverseProxy --version 1.1.0-rc.1.22211.2
NuGet
Update Yarp.ReverseProxy to 1.0.1 or laterdotnet add package Yarp.ReverseProxy --version 1.0.1
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: nuget (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Yarp.ReverseProxy | nuget | 1.1.0-rc.1.22152.1 | 1.1.0-rc.1.22211.2 |
| Yarp.ReverseProxy | nuget | 1.0.0 | 1.0.1 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-8xc6-g8xw-h2c4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-26924ADVISORY
- https://github.com/microsoft/reverse-proxy/commit/11e6272da17beb03d0b44a19d3c4f1ffa52b7c38WEB
- https://github.com/microsoft/reverse-proxyPACKAGE
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26924WEB
Frequently Asked Questions
- What is CVE-2022-26924?
- YARP Denial of Service Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
- How do I check if my project is affected by CVE-2022-26924?
- CVE-2022-26924 affects Yarp.ReverseProxy. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-26924 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.5
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-8xc6-g8xw-h2c4
Related CVEs
- CVE-2026-106112HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
- CVE-2026-106115HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
- CVE-2023-33141HIGH
YARP Denial of Service Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies