Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

.NET Elevation of Privilege Vulnerability

.NET SDK Elevation of Privilege Vulnerability

.NET Framework Remote Code Execution Vulnerability

.NET Elevation of Privilege Vulnerability

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory. An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.

Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness.

Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update payloads, enabling attacker‑supplied executables to be accepted and later executed by the application.

Critically, Ollama for Windows performs silent automatic updates, so the malicious payload may be installed automatically without user awareness.

Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 6.1 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-116

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109476

Acknowledgements

- Raffaello Tamagnini

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/515

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-407

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.linux-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.osx-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-arm64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x64 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6 Microsoft.AspNetCore.App.Runtime.win-x86 | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109478

Acknowledgements

- Matteo Panzeri

Revisions

V1.0 (November 10, 2026): Advisory published.

.NET Elevation of Privilege Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/504

CVSS Details

- Version: 3.1 - Severity: Critical - Score: 9.0 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-863

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

ASP.NET Core 2.3 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Http.Connections | >= 1.2.0, <= 1.2.13 | 1.2.14

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114146

Acknowledgements

- Mika Vehns with MIVE GmbH - Lucas Gabriel - hsuan0223x - Mariusz Maik - Pocas (Jeongwon Jo) - Grace Chapel - Jacob Keith with Keith Systems - Weeraphat Srisutham - Kevin Gosse - Artur Stetsko - Yudai Shibata - 71C4 - Attila Csatadi of ZeroDayBugs.com - Vu Van Tien ( @n0Be3r )

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/509

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-401

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

8.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

9.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

10.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

11.0 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.SignalR.StackExchangeRedis | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Compare the deployed ASP.NET Core runtime and the application's resolved Microsoft.AspNetCore.SignalR.StackExchangeRedis package version with the affected ranges above. Self-contained applications include their own runtime.

<a name="how-fix"></a>How do I fix the issue?

Update both the ASP.NET Core runtime and the Microsoft.AspNetCore.SignalR.StackExchangeRedis package to the applicable patched versions above. Restart affected framework-dependent applications after installing the runtime update. Rebuild and redeploy applications after updating the package; self-contained applications must also be rebuilt with the patched runtime. Updating a machine-wide runtime or SDK alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114147

Acknowledgements

- 71C4 with ARPSEC - 71C4

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Multipart form processing can bypass the configured header-count limit and consume excessive resources.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-770

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone WebUtilities delivery

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.WebUtilities | >= 8.0.0-preview.5.23302.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.WebUtilities | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.WebUtilities | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.WebUtilities | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114149

Acknowledgements

- n0irx

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

The Blazor/SignalR /blazor/refresh path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/506

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-352

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-109481

Acknowledgements

- Derek Haber with Armadin - Anonymous - Artur Stetsko - s3zer0 - Leonardo Souza with Delfia - Attila.Cs(zerodaybugs.com) with https://zerodaybugs.com/

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

PathString.StartsWithSegments can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/510

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 6.5 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C - Weakness: CWE-41

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114156

Acknowledgements

- Anonymous

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

A reused ResponseBufferingStream can retain pooled tail memory and expose response-body data from another request through HTTP logging.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/514

CVSS Details

- Version: 3.1 - Severity: Medium - Score: 5.9 (base score) - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-908

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114150

Acknowledgements

- Kevin Gosse

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-407

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone validation delivery

Package | Affected version | Patched version --- | --- | --- Microsoft.Extensions.Validation | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118749

Acknowledgements

- Alejandro Pacheco - Artur Stetsko

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/516

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-770

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118748

Acknowledgements

- Artur Stetsko - Alejandro Pacheco

Revisions

V1.0 (November 10, 2026): Advisory published.

.NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.8 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-122

Affected Platforms

- Platforms: Windows - Architectures: x86, x64, Arm64

<a name="affected-packages"></a>Affected Packages

On Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs.

.NET on Windows

Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows self-contained runtime packs

These runtime packs deliver the .NET runtime for Windows self-contained applications.

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows SDK distributions

These Windows SDK distributions are affected through their bundled .NET runtime.

Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100

Windows SDK updates

Update each installed SDK feature band to the following version or later:

- .NET SDK 8.0.1xx: 8.0.134 - .NET SDK 8.0.4xx: 8.0.428 - .NET SDK 9.0.1xx: 9.0.124 - .NET SDK 9.0.3xx: 9.0.321 - .NET SDK 10.0.1xx: 10.0.115 - .NET SDK 10.0.4xx: 10.0.404 - .NET SDK 11.0.1xx: 11.0.100

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Applications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 on Windows x86, x64, and Arm64 to read crafted native PDBs are exposed. See affected packages for the affected .NET products on Windows.

<a name="how-fix"></a>How do I fix the issue?

Update affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.

Microsoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Announcement

https://github.com/dotnet/announcements/issues/524

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118745

Acknowledgements

- Quac Tran

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

A Portable PDB EmbeddedSource record with parent RID 0 can trigger an out-of-bounds write.

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.8 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-122

Affected Platforms

- Platforms: Windows - Architectures: x86, x64, Arm64

<a name="affected-packages"></a>Affected Packages

Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a crafted Portable PDB containing an EmbeddedSource record with parent RID 0. The Windows runtime's native stack-trace reader can reach this initialization through its native-reader fallback.

.NET on Windows

Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows runtime packages for self-contained applications

The following packages deliver the affected .NET native reader. Exposure requires the PDB-reading operation described above; the presence of the reader does not make every application or symbol-reading path vulnerable.

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows SDK updates

The following SDK updates include the corrected .NET runtime. Update each installed Windows SDK feature band:

Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx on Windows | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx on Windows | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx on Windows | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx on Windows | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx on Windows | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx on Windows | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx on Windows | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Applications using Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed above to initialize the native reader with a crafted Portable PDB containing an EmbeddedSource record with parent RID 0 are exposed on x86, x64, and Arm64. The Windows runtime's native stack-trace reader can reach this initialization when PE metadata selects its native-reader fallback. See affected packages for the affected .NET products on Windows.

<a name="how-fix"></a>How do I fix the issue?

Update affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.

For applications that deploy their own .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/520

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114158

Acknowledgements

- h4urek with secsys lab

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

An oversized Portable PDB document name can be truncated during allocation and cause a heap out-of-bounds write.

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.8 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-122

Affected Platforms

- Platforms: Windows - Architectures: x86, x64, Arm64

<a name="affected-packages"></a>Affected Packages

Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a Portable PDB containing an oversized document name. The Windows runtime's native stack-trace reader can reach this initialization through its native-reader fallback.

.NET on Windows

Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows runtime packages for self-contained applications

The following packages deliver the affected .NET native reader. Exposure requires the PDB-reading operation described above; the presence of the reader does not make every application or symbol-reading path vulnerable.

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows SDK updates

The following SDK updates include the corrected .NET runtime. Update each installed Windows SDK feature band:

Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx on Windows | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx on Windows | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx on Windows | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx on Windows | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx on Windows | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx on Windows | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx on Windows | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Applications using Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed above to initialize the native reader with a Portable PDB containing an oversized document name are exposed on Windows x86, x64, and Arm64. The Windows runtime's native stack-trace reader can reach this initialization when PE metadata selects its native-reader fallback. See affected packages for the affected .NET products on Windows.

<a name="how-fix"></a>How do I fix the issue?

Update affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.

For applications that deploy their own .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/521

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114159

Acknowledgements

- h4urek with secsys lab

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core's Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components.

A Kestrel named-pipe listener configured with CurrentUserOnly can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/507

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C - Weakness: CWE-362 - MSRC severity: Important - Impact: Security Feature Bypass

Affected Platforms

- Platforms: Windows - Architectures: Arm64, x64, x86

<a name="affected-packages"></a>Affected Packages

Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes ships in the ASP.NET Core shared framework and runtime packs; it is not a separately packable NuGet package.

Affected intervals and patched release versions are listed below.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

The .NET 11.0.0 release is fixed; affected prereleases are listed above.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Review Windows applications that use Kestrel's Named Pipes transport and identify their deployed ASP.NET Core versions. Compare deployed versions with the affected intervals above. Self-contained applications include their own framework; updating a machine-wide installation does not replace their embedded copies.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable ASP.NET Core runtime update and restart applications. Rebuild and redeploy affected self-contained applications with fixed runtime packs. An SDK update alone does not replace runtime or framework files already embedded in deployed applications. Use the patched version listed for the affected servicing line.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114157

Acknowledgements

- Antonio Alonso-Stepanov

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/513

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-401

Affected Platforms

- Platforms: Windows - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

ASP.NET Core 2.3 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Server.HttpSys | = 2.3.10 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.11 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.12 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.13 | 2.3.14

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.14 | 10.0.15

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Update standalone Microsoft.AspNetCore.Server.HttpSys references to 2.3.14, then rebuild and redeploy affected applications, including framework-dependent applications. Install the applicable patched runtime version listed above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114154

Acknowledgements

- Kevin Gosse

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Attacker-controlled COFF relocation offsets can cause an out-of-bounds stack write in DiaObjectFile::ApplyFixup.

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.8 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-121, CWE-822

Affected Platforms

- Platforms: Windows - Architectures: x86, x64, Arm64

<a name="affected-packages"></a>Affected Packages

Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when loading document specifications from a PDB that references an attacker-influenced COFF object.

.NET on Windows

Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows self-contained runtime packs

These runtime packs deliver the .NET runtime for Windows self-contained applications.

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows SDK distributions

These Windows SDK distributions are affected through their bundled .NET runtime.

Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100

Windows SDK updates

Update each installed SDK feature band to the following version or later:

- .NET SDK 8.0.1xx: 8.0.134 - .NET SDK 8.0.4xx: 8.0.428 - .NET SDK 9.0.1xx: 9.0.124 - .NET SDK 9.0.3xx: 9.0.321 - .NET SDK 10.0.1xx: 10.0.115 - .NET SDK 10.0.4xx: 10.0.404 - .NET SDK 11.0.1xx: 11.0.100

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Applications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 to load document specifications from a PDB that references an attacker-influenced COFF object are exposed on x86, x64, and Arm64. The SDK distributions listed above are affected through their bundled .NET runtime. See affected packages for the affected .NET products on Windows.

<a name="how-fix"></a>How do I fix the issue?

Update affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.

Microsoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Announcement

https://github.com/dotnet/announcements/issues/523

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114152

Acknowledgements

- C0rk1 - 41ae55e9310ff27fa6f26af4727e5590

Revisions

V1.0 (November 10, 2026): Advisory published.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

A crafted PDB LFDECIMAL payload can trigger an out-of-bounds stack write when processed by DIA.

CVSS Details

- Version: 3.1 - Severity: High - Score: 8.8 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-502, CWE-121

Affected Platforms

- Platforms: Windows - Architectures: x86, x64, Arm64

<a name="affected-packages"></a>Affected Packages

Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through ISymUnmanagedConstant.GetValue. The .NET runtime's native stack-trace reading path does not call ISymUnmanagedConstant.GetValue. This excludes that invocation, not the .NET product as a whole.

.NET on Windows

Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows self-contained runtime packs

These runtime packs deliver the .NET runtime for Windows self-contained applications.

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0

Windows SDK distributions

These Windows SDK distributions are affected through their bundled .NET runtime.

Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100

Windows SDK updates

Update each installed SDK feature band to the following version or later:

- .NET SDK 8.0.1xx: 8.0.134 - .NET SDK 8.0.4xx: 8.0.428 - .NET SDK 9.0.1xx: 9.0.124 - .NET SDK 9.0.3xx: 9.0.321 - .NET SDK 10.0.1xx: 10.0.115 - .NET SDK 10.0.4xx: 10.0.404 - .NET SDK 11.0.1xx: 11.0.100

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Applications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 to read constants from attacker-supplied PDBs through ISymUnmanagedConstant.GetValue are exposed on x86, x64, and Arm64. The .NET runtime's native stack-trace reading path does not call ISymUnmanagedConstant.GetValue. This excludes that invocation, not the .NET product as a whole. See affected packages for the affected .NET products on Windows.

<a name="how-fix"></a>How do I fix the issue?

Update affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.

Microsoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114151

Acknowledgements

- 41ae55e9310ff27fa6f26af4727e5590

Revisions

V1.0 (November 10, 2026): Advisory published.

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

Chromium: CVE-2026-17992 Uninitialized Use in Skia