This appears to be the code change: https://github.com/dotnet/aspnetcore/commit/97a86434195a82fc...

Looks like a line ending problem. RejectsInvalidChunkExtensions seems to be the unit test that covers the actual concern.

This is a dumb way of scoring the bug.

The bug itself doesn't enable any of those. An app using the library might have that vuln.

It's a generic problem with using CVSS to score library vulnerabilities. CVSS is designed around complete systems, so it's totally crap to apply it to libraries.

I see a lot of critical (9+) supposed JavaScript "remote code execution with no authentication" CVEs being posted...

Right, if you are running it in an NPM server exposed to malicious user input with no authentication. Actually it runs client side in the browser and at best it's a prototype pollution vuln with a much lower score.

> This is a dumb way of scoring the bug.

The above is a motto for the entire vulnerability industrial complex.

Score which is based how someone could theoretically use the tool.

It might be right, but it also feels so wrong.

I would in reality probably rank this issue lower. And in some more properly engineered systems it would have lot less criticality.

But:

> someone could theoretically use the tool

makes every single logic error a 9.9