| Package | Affected versions | Patched versions |
|---|---|---|
| Yarp.ReverseProxy | ≥ 2.0.0, < 2.0.1< 1.1.2 | 2.0.11.1.2 |
| yet another reverse proxy | = 2.0.0≥ 1.0.0, < 1.1.2 | 1.1.2 |
A denial of service vulnerability exists in YARP.
If you're using YARP 1.x, you should update to NuGet package version 1.1.2. If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.
You can do so by updating the PackageReference in your .csproj file
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>
or by selecting 2.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free