-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Xen Security Advisory CVE-2026-99286 / XSA-531

Linux xen-netback: guest can trigger use-after-free for network statistics reads

ISSUE DESCRIPTION =================

The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), there was missing RCU synchronization before freeing the memory holding the statistic data. This was meant to be fixed by the patch of XSA-526, but that patch failed to set the indication that the data should no longer be accessed, before waiting for RCU to have finished accesses. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.

IMPACT ======

The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host.

Information leaks cannot be ruled out.

VULNERABLE SYSTEMS ==================

Linux versions 4.11 and newer are vulnerable. Note that the patch for XSA-526 is still needed.

MITIGATION ==========

Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem.

Using a dedicated network driver domain per guest will mitigate the problem.

CREDITS =======

This issue was discovered by Tu Dinh of Vates.

RESOLUTION ==========

Applying the attached patch resolves this issue.

xsa531-linux.patch Linux

$ sha256sum xsa531 1da1dc0543ad3b61698e6d9afc90720bb54f314b6fbc58ab83b8ee0b86fda086 xsa531-linux.patch $

NOTE REGARDING LACK OF EMBARGO ==============================

The issue is directly related to the recent XSA-526 fix and easy to find. -----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrzZgUMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZLHgH/i0+e6pRQkH5mI9w/GPnPDy/QGSVjEaLqj72Oo/9 NOi1fEwHibm7JPOO/NpZHDcGvh2Y5PT7DRlVw1+1EV2+lbLzbxHX2BWVySQx9cPk jBKem0k1udcCsKGxe09/wPW53NPmfw3KARs9L1KEJZl5/akXTUX3ZjSIOyoRg9oE nCmbgcfg2m+KfFGnrieQaiiMOO2iD2KZmeJFLsGaT007wVkeFx2vJBxEdTayiMvF A6BwRTc8gBd3iLxgBMO7Wdz5h3uWlgjDYq8E52tzMFbII3OeYCiiyStYlYFMk3la sVr8bYFcctn1xm4/XukqoS00EVcNVYqaQl1yxkDf8im9qZs= =KIyG -----END PGP SIGNATURE-----

.NET Elevation of Privilege Vulnerability

.NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-407

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone validation delivery

Package | Affected version | Patched version --- | --- | --- Microsoft.Extensions.Validation | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118749

Acknowledgements

- Alejandro Pacheco - Artur Stetsko

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/516

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-770

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118748

Acknowledgements

- Artur Stetsko - Alejandro Pacheco

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

PathString.StartsWithSegments can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/510

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 6.5 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C - Weakness: CWE-41

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114156

Acknowledgements

- Anonymous

Revisions

V1.0 (November 10, 2026): Advisory published.

.NET Security Feature Bypass Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

A reused ResponseBufferingStream can retain pooled tail memory and expose response-body data from another request through HTTP logging.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/514

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 5.9 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-908

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114150

Acknowledgements

- Kevin Gosse

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/509

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-401

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

8.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

9.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

10.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

11.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Compare the deployed ASP.NET Core runtime and the application's resolved Microsoft.AspNetCore.SignalR.StackExchangeRedis package version with the affected ranges above. Self-contained applications include their own runtime.

<a name="how-fix"></a>How do I fix the issue?

Update both the ASP.NET Core runtime and the Microsoft.AspNetCore.SignalR.StackExchangeRedis package to the applicable patched versions above. Restart affected framework-dependent applications after installing the runtime update. Rebuild and redeploy applications after updating the package; self-contained applications must also be rebuilt with the patched runtime. Updating a machine-wide runtime or SDK alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114147

Acknowledgements

- 71C4 with ARPSEC - 71C4

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Multipart form processing can bypass the configured header-count limit and consume excessive resources.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-770

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone WebUtilities delivery

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.WebUtilities | >= 8.0.0-preview.5.23302.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.WebUtilities | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.WebUtilities | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.WebUtilities | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114149

Acknowledgements

- n0irx

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

The Blazor/SignalR /blazor/refresh path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/506

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-352

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109481

Acknowledgements

- Derek Haber with Armadin - Anonymous - Artur Stetsko - s3zer0 - Leonardo Souza with Delfia - Attila.Cs(zerodaybugs.com) with https://zerodaybugs.com/

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/504

CVSS Details

- Version: 3.1 - Severity: Critical - Score: 9.0 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-863

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

ASP.NET Core 2.3 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Http.Connections | >= 1.2.0, <= 1.2.13 | 1.2.14

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114146

Acknowledgements

- Mika Vehns with MIVE GmbH - Lucas Gabriel - hsuan0223x - Mariusz Maik - Pocas (Jeongwon Jo) - Grace Chapel - Jacob Keith with Keith Systems - Weeraphat Srisutham - Kevin Gosse - Artur Stetsko - Yudai Shibata - 71C4 - Attila Csatadi of ZeroDayBugs.com - Vu Van Tien ( @n0Be3r )

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 6.1 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-116

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109476

Acknowledgements

- Raffaello Tamagnini

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/515

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-407

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109478

Acknowledgements

- Matteo Panzeri

Revisions

V1.0 (November 10, 2026): Advisory published.

.NET Denial of Service Vulnerability

.NET Elevation of Privilege Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Xen Security Advisory CVE-2026-100080 / XSA-526

Linux xen-netback: guest can trigger use-after-free for network statistics reads

ISSUE DESCRIPTION =================

The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.

IMPACT ======

The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host.

Information leaks cannot be ruled out.

VULNERABLE SYSTEMS ==================

Linux versions 4.11 and newer are vulnerable.

MITIGATION ==========

Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem.

Using a dedicated network driver domain per guest will mitigate the problem.

CREDITS =======

This issue was discovered by Yehyeong Lee of Hyundai Mobis.

RESOLUTION ==========

Applying the attached patch resolves this issue.

xsa526-linux.patch Linux

$ sha256sum xsa526 88dd41b89b43fa1b14e68c1a40aa69a22309e0c57a1b5543168949a273627ca8 xsa526-linux.patch $

NOTE REGARDING LACK OF EMBARGO ==============================

This issue was disclosed in public. -----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrt7ssMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZq84H/02MP77ou0FS+9nAF8CWbGl79KfiUWO2xjXPEdKB Mgyzk0Gtq+Q0/oTaxPC59f9Pxc4yiCnGuIjpVM2qPOfaHZD0uEnzzGEROxVNCABq 7wCxZ/9Uu3MXO+1rcMgVqUNoHEqYLxgSp3OZ7O48DFQtkulP6fp4EgR0xTUIgPwn oKlWoSKORAXOkULt5Qn5xI0+YN0OgDMdHKj/BPkRIGeeqOHPRcUmeZU9VRnOiATh v1lR6erAWEx/dwr5Yq6ZReA6GFgDNRRk7ersnc5mwxxUyDtJtNXPHUCmE8AZ/q4C H2I/1SLzm6oa+v+0fngSasn9+lMZC6fzy0SxRJF3clRui+A= =uEqL -----END PGP SIGNATURE-----

ASP.NET Core Elevation of Privilege Vulnerability

Summary

Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.

erl-brotli compiles its own copy of the Google Brotli C sources under csrc into a NIF, and brotlidecoderdecompressstream in csrc/brotlinif.c hands the input to BrotliDecoderDecompressStream. In csrc/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.

This issue affects brotli: from 0.3.0 before 0.3.4.

Impact

An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.

A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.

The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.

A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.

.NET Framework Security Feature Bypass Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Remote Code Execution Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

DateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/481

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

- Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.NETCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.win-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.NETCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.NETCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-96233

Acknowledgements

- s3zer0

Revisions

V1.0 (10/13/2026): Advisory published.

.NET Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

ASP.NET Core Identity password-reset and confirmation flows can send mail to the unvalidated request address instead of the user's stored canonical address.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/457

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.1 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-640 (Weak Password Recovery Mechanism for Forgotten Password)

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-70175

Acknowledgements

- Elemperor - Attila.Cs (zerodaybugs.com) with https://zerodaybugs.com/

Revisions

V1.0 (10/13/2026): Advisory published.