CVE-2009-1536
LowExploitedASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP…
Published Aug 12, 2009 · Updated Apr 22, 2026
Key Facts
Patch immediately- CVE-2009-1536 is a low-severity vulnerability (CVSS 2.6 v2) affecting .net Framework (Microsoft), Windows Server 2008 (Microsoft), Windows Vista (Microsoft).
- It is exploited in the wild, listed in Industry KEV feed since Aug 13, 2009. No public exploit code is known.
- EPSS estimates a 51% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v2
2.6
AV:N/AC:H/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
51%
Higher than 98.9% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
None known
Get the full CVE-2009-1536 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Aug 13, 2009 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
7 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| .net FrameworkMicrosoft | 2.0-sp1, 2.0-sp2, 3.5, 3.5-sp1 | n/a |
| Windows Server 2008Microsoft | See advisory | n/a |
| Windows VistaMicrosoft | See advisory | n/a |
Timeline
Publicly disclosed
Aug 12, 2009
Added to Industry KEV feed
Aug 13, 2009
Last updated
Apr 22, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisoryhttp://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
- advisory36127
- advisoryoval:org.mitre.oval:def:6393
- advisory1022715
- advisoryTA09-223A
FAQ
Common Questions.
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial…
Affected: .net Framework (Microsoft) versions 2.0-sp1, 2.0-sp2, 3.5, 3.5-sp1; Windows Server 2008 (Microsoft); Windows Vista (Microsoft). The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Aug 13, 2009.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2009-1536 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo