GHSA-p3jp-9v83-76w9: Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Published Nov 3, 2026
·
Updated

Executive summary

A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/494

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.1 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-787 (Out-of-bounds Write)

Affected Platforms

- Platforms: All - Architectures: All

Mitigations

ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:

- Enable ASP.NET Core automatic request decompression with Brotli (br) support. - Enable HttpClient automatic response decompression by configuring HttpClientHandler.AutomaticDecompression or SocketsHttpHandler.AutomaticDecompression to include DecompressionMethods.Brotli or DecompressionMethods.All. - Explicitly use Brotli decompression APIs in System.IO.Compression, such as BrotliStream or BrotliDecoder.

Until the update can be deployed, avoid decompressing attacker-controlled Brotli data.

The following examples show how to disable Brotli decompression if you are already using it.

Warning: Do not use these code snippets if you are not already using decompression. Do not introduce a call to AddRequestDecompression if your application does not already call it. Similarly, do not introduce an AutomaticDecompression property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.

If you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the br entry from your existing decompression configuration. This retains the default gzip and deflate providers:

csharp builder.Services.AddRequestDecompression(options => { options.DecompressionProviders.Remove("br"); });

If your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include DecompressionMethods.Brotli:

csharp var handler = new HttpClientHandler { AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate };

var httpClient = new HttpClient(handler);

Applications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.

<a name="affected-packages"></a>Affected Packages

The vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.

.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.DotNet.ILCompiler | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.android-arm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.android-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.android-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.android-x86 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.browser-wasm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.ios-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.linux-arm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.linux-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.linux-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.osx-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.osx-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.wasi-wasm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.win-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.Mono.win-x86 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-arm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-bionic-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-bionic-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.linux-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.osx-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.33 | 8.0.33 Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.33 | 8.0.33

.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.DotNet.ILCompiler | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.android-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.android-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.android-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.android-x86 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.browser-wasm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.ios-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.Mono.wasi-wasm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-bionic-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-bionic-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.linux-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.osx-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.22 | 9.0.22 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.22 | 9.0.22

.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.DotNet.ILCompiler | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.android-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.android-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.android-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.android-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.android-x86 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.browser-wasm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.ios-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.Mono.wasi-wasm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.android-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.android-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-bionic-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-bionic-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.linux-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.osx-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.14 | 10.0.14 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.14 | 10.0.14

.NET 11 previews

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.DotNet.ILCompiler | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.android-arm | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.android-arm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.android-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.android-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.android-x86 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.browser-wasm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.ios-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.Mono.wasi-wasm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.android-arm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.android-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.android-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.browser-wasm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.ios-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.iossimulator-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.iossimulator-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-bionic-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-bionic-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.maccatalyst-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.maccatalyst-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.tvos-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.tvossimulator-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.tvossimulator-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

You are affected if your application uses an affected Brotli decoder included in a package listed in affected packages, including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See mitigations for the affected usage paths and default settings.

<a name="how-fix"></a>How do I fix the issue?

Install the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.

.NET release | Runtime | SDK versions ------------ | ------- | ------------ .NET 8 | 8.0.33 | 8.0.133, 8.0.427 .NET 9 | 9.0.22 | 9.0.123, 9.0.320 .NET 10 | 10.0.14 | 10.0.114, 10.0.403 .NET 11 previews | 11.0.0-rc.3.26522.148 | 11.0.100-rc.3.26522.148

Download .NET from https://dotnet.microsoft.com/download/dotnet.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

If you have deployed self-contained applications, rebuild and redeploy those applications with the updated runtime.

For NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine's shared runtime alone does not replace a decoder already linked into a NativeAOT executable.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-111497

Revisions

V1.0 (10/25/2026): Initial advisory.

Affected Software

218 affected componentsFixes available
nuget/microsoft.netcore.app.runtime.win-x86>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.win-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.win-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.tvossimulator-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.tvossimulator-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.tvos-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.osx-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.osx-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.maccatalyst-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.maccatalyst-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-musl-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-musl-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-musl-arm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-bionic-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-bionic-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.linux-arm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.iossimulator-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.iossimulator-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.ios-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.browser-wasm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.android-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.android-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.android-arm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.wasi-wasm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.tvos-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.multithread.browser-wasm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.iossimulator-x64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.iossimulator-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.ios-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.browser-wasm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.android-x86>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.android-arm64>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.mono.android-arm>=11.0.0-preview.1<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.win-x86>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.win-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.tvos-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.osx-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.osx-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.ios-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.android-x64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.android-arm64>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.nativeaot.android-arm>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.dotnet.ilcompiler>=11.0.0-preview.1.26104.118<11.0.0-rc.3.26522.148
11.0.0-rc.3.26522.148
nuget/microsoft.netcore.app.runtime.win-x86>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.win-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.win-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.osx-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.osx-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-musl-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-musl-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-musl-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-bionic-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-bionic-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.linux-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.android-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.android-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.wasi-wasm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.tvos-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.multithread.browser-wasm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.iossimulator-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.iossimulator-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.ios-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.browser-wasm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.android-x86>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.android-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.mono.android-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.win-x86>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.win-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.dotnet.ilcompiler>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.ios-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.osx-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.osx-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.tvos-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.llvm.linux-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.llvm.linux-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.llvm.osx-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.android-arm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.android-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.android-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.browser-wasm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.ios-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.iossimulator-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.iossimulator-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.linux-arm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.linux-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.linux-musl-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.linux-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.multithread.browser-wasm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.osx-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.osx-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.tvos-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.wasi-wasm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.win-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.mono.win-x86>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-arm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-bionic-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-bionic-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-musl-arm>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-musl-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-musl-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.linux-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.osx-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.osx-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.win-arm64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.win-x64>=8.0.0<8.0.33
8.0.33
nuget/microsoft.netcore.app.runtime.win-x86>=8.0.0<8.0.33
8.0.33
nuget/microsoft.dotnet.ilcompiler>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.ios-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.linux-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.osx-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.osx-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.tvos-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.win-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.nativeaot.win-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.android-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.android-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.android-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.browser-wasm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.ios-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.iossimulator-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.iossimulator-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.maccatalyst-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.multithread.browser-wasm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.tvos-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.tvossimulator-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.mono.wasi-wasm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-bionic-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-bionic-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-musl-arm>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-musl-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-musl-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.linux-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.osx-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.osx-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.win-arm64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.win-x64>=9.0.0<9.0.22
9.0.22
nuget/microsoft.netcore.app.runtime.win-x86>=9.0.0<9.0.22
9.0.22
nuget/microsoft.dotnet.ilcompiler>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.android-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.android-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.android-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.ios-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.iossimulator-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-bionic-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-musl-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.linux-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.maccatalyst-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.osx-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.osx-x64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.tvos-arm64>=10.0.0<10.0.14
10.0.14
nuget/microsoft.netcore.app.runtime.nativeaot.tvossimulator-arm64>=10.0.0<10.0.14
10.0.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x86 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  2. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  3. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  4. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  5. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  6. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  7. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  8. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  9. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  10. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  11. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  12. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  13. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  14. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  15. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  16. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  17. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  18. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  19. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  20. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  21. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  22. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.browser-wasm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  23. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.android-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  24. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.android-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  25. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.android-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  26. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  27. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  28. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  29. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  30. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  31. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  32. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  33. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  34. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  35. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  36. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.browser-wasm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  37. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x86 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  38. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  39. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  40. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  41. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  42. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  43. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  44. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  45. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  46. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  47. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  48. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  49. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  50. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  51. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  52. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  53. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  54. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  55. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  56. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  57. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  58. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  59. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  60. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  61. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  62. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  63. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  64. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  65. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  66. Upgrade

    Upgrade nuget/Microsoft.DotNet.ILCompiler to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  67. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x86 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  68. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  69. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  70. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  71. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  72. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  73. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  74. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  75. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  76. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  77. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  78. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  79. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  80. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.android-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  81. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.android-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  82. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  83. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  84. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  85. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  86. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  87. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  88. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  89. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  90. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  91. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  92. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.browser-wasm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  93. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x86 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  94. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  95. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  96. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  97. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  98. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  99. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  100. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  101. Upgrade

    Upgrade nuget/Microsoft.DotNet.ILCompiler to a version that resolves this vulnerability.

    Fixed in 8.0.33
  102. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  103. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  104. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  105. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  106. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  107. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  108. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  109. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  110. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  111. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  112. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  113. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  114. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  115. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  116. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  117. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  118. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  119. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  120. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x86 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  121. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.browser-wasm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  122. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  123. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  124. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  125. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.linux-arm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  126. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  127. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  128. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.linux-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  129. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  130. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  131. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  132. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  133. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.osx-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  134. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  135. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  136. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  137. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  138. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.win-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  139. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.win-x86 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  140. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  141. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  142. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  143. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  144. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 8.0.33
  145. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  146. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  147. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  148. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  149. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  150. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-arm64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  151. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x64 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  152. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x86 to a version that resolves this vulnerability.

    Fixed in 8.0.33
  153. Upgrade

    Upgrade nuget/Microsoft.DotNet.ILCompiler to a version that resolves this vulnerability.

    Fixed in 9.0.22
  154. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  155. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  156. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  157. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  158. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  159. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  160. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  161. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  162. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  163. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  164. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  165. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  166. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  167. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  168. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  169. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  170. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  171. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  172. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  173. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  174. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  175. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  176. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  177. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  178. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  179. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.android-x86 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  180. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.browser-wasm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  181. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  182. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  183. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  184. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  185. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  186. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  187. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  188. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  189. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  190. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  191. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  192. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  193. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  194. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  195. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 9.0.22
  196. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  197. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  198. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.linux-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  199. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  200. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.osx-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  201. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-arm64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  202. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x64 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  203. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.win-x86 to a version that resolves this vulnerability.

    Fixed in 9.0.22
  204. Upgrade

    Upgrade nuget/Microsoft.DotNet.ILCompiler to a version that resolves this vulnerability.

    Fixed in 10.0.14
  205. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  206. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  207. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  208. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  209. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  210. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  211. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  212. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  213. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  214. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  215. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  216. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm to a version that resolves this vulnerability.

    Fixed in 10.0.14
  217. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  218. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  219. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  220. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  221. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  222. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  223. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  224. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  225. Upgrade

    Upgrade nuget/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 to a version that resolves this vulnerability.

    Fixed in 10.0.14
  226. Upgrade

    Upgrade .NET 8 runtime and affected runtime packages to a version that resolves this vulnerability.

    Fixed in 8.0.33
  227. Upgrade

    Upgrade .NET 9 runtime and affected runtime packages to a version that resolves this vulnerability.

    Fixed in 9.0.22
  228. Upgrade

    Upgrade .NET 10 runtime and affected runtime packages to a version that resolves this vulnerability.

    Fixed in 10.0.14
  229. Upgrade

    Upgrade .NET 11 previews runtime and affected runtime packages to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.3.26522.148
  230. Upgrade

    Upgrade .NET SDK 8 to a version that resolves this vulnerability.

    Fixed in 8.0.133
  231. Upgrade

    Upgrade .NET SDK 8 to a version that resolves this vulnerability.

    Fixed in 8.0.427
  232. Upgrade

    Upgrade .NET SDK 9 to a version that resolves this vulnerability.

    Fixed in 9.0.123
  233. Upgrade

    Upgrade .NET SDK 9 to a version that resolves this vulnerability.

    Fixed in 9.0.320
  234. Upgrade

    Upgrade .NET SDK 10 to a version that resolves this vulnerability.

    Fixed in 10.0.114
  235. Upgrade

    Upgrade .NET SDK 10 to a version that resolves this vulnerability.

    Fixed in 10.0.403
  236. Upgrade

    Upgrade .NET SDK 11 previews to a version that resolves this vulnerability.

    Fixed in 11.0.100-rc.3.26522.148
  237. Configuration

    If Brotli request decompression is already enabled, remove the "br" entry from the existing decompression configuration; do not introduce AddRequestDecompression when it is not already used.

    ASP.NET Core request decompression DecompressionProviders = remove "br"
  238. Configuration

    If automatic response decompression is already enabled, update the existing flags so they do not include DecompressionMethods.Brotli; retain only the required non-Brotli providers such as GZip and Deflate.

    HttpClientHandler or SocketsHttpHandler AutomaticDecompression = exclude DecompressionMethods.Brotli
  239. Compensating control

    Until the update is deployed, avoid decompressing attacker-controlled Brotli data and stop passing untrusted Brotli data to direct Brotli decompression APIs such as BrotliStream or BrotliDecoder.

  240. Operational

    For self-contained applications, rebuild and redeploy with the updated runtime; for NativeAOT applications, update the SDK and explicit compiler or runtime-pack references, then republish and redeploy.

  241. Operational

    Restart applications after installing the updated runtime or SDK so the update takes effect.

Event History

Nov 3, 2026
Advisory Published
via GitHub·05:33 PM
Data Sourced
via GitHub·05:33 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which applications are exposed?

Applications are exposed only if they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data. Merely having an affected .NET package installed does not make an application exposed.

2

Are ASP.NET Core and HttpClient applications affected by default?

No. ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default.

3

Does this affect .NET Framework or only particular operating systems and architectures?

.NET Framework is not affected. The advisory lists all platforms and all architectures as affected for the applicable .NET runtimes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203