| Package | Affected versions | Patched versions |
|---|---|---|
| Yarp.ReverseProxy | ≥ 1.1.0-rc.1.22152.1, < 1.1.0-rc.1.22211.2< 1.0.1 | 1.1.0-rc.1.22211.21.0.1 |
| yet another reverse proxy | = 1.0.0= 1.1.0 |
A denial of service vulnerability exists in how YARP processes input.
If you're using YARP 1.0.0, you should update to NuGet package version 1.0.1.
If you're using YARP 1.1.0-RC.1, you should update to NuGet package version 1.1.0-rc.1.22211.2.
You can do so by updating the PackageReference in your .csproj file
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="1.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="1.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.1" />
</ItemGroup>
or by selecting 1.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free