CVE-2023-21538

.NET Denial of Service Vulnerability

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Name	Vendor	Start Version	End Version
.net	Microsoft	6.0.0 (including)	6.0.0 (including)
Powershell	Microsoft	7.2 (including)	7.2 (including)
.NET Core on Red Hat Enterprise Linux	RedHat	rh-dotnet60-dotnet-0:6.0.113-1.el7_9	*
Red Hat Enterprise Linux 8	RedHat	dotnet6.0-0:6.0.113-1.el8_7	*
Red Hat Enterprise Linux 9	RedHat	dotnet6.0-0:6.0.113-1.el9_1	*
Dotnet6	Ubuntu	devel	*
Dotnet6	Ubuntu	jammy	*
Dotnet6	Ubuntu	kinetic	*
Dotnet6	Ubuntu	upstream	*

Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-21538
CWE	https://cwe.mitre.org/data/definitions/502.html

Deserialization of Untrusted Data