CVE-2021-26701

.NET Core Remote Code Execution Vulnerability

8.1 HighFix available

.NET Core Remote Code Execution Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

30.1%Up 0.1 points since Apr 14, 2021

What each source reports

CVE List Score used 8.1

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability

Record: CVE-2021-26701
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

EUVDEUVD-2021-0826 8.1

.NET Core Remote Code Execution Vulnerability

Record: EUVD-2021-0826
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-ghhp-997w-qr28 9.8

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Record: GHSA-ghhp-997w-qr28
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 8.1

.NET Core Remote Code Execution Vulnerability

Record: CVE-2021-26701
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

OSV 8.1

.NET Core Remote Code Execution Vulnerability

Record: CVE-2021-26701
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-ghhp-997w-qr28 9.8

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Record: GHSA-ghhp-997w-qr28
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2021:0787 8.1

Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update

Record: RHSA-2021:0787
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0788 8.1

Red Hat Security Advisory: dotnet security and bugfix update

Record: RHSA-2021:0788
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0789 8.1

Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update

Record: RHSA-2021:0789
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0790 8.1

Red Hat Security Advisory: dotnet3.1 security and bugfix update

Record: RHSA-2021:0790
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0793 8.1

Red Hat Security Advisory: .NET Core on RHEL 8 security and bugfix update

Record: RHSA-2021:0793
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:0794 8.1

Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update

Record: RHSA-2021:0794
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-dotnet-2021-26701 No score

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability

Record: BIT-dotnet-2021-26701
Updated: 2026-11-02

OSVBIT-dotnet-sdk-2021-26701 No score

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability

Record: BIT-dotnet-sdk-2021-26701
Updated: 2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`System.Text.Encodings.Web` NuGet	4.0.0 up to 4.5.1	4.5.1
`System.Text.Encodings.Web` NuGet	4.6.0 up to 4.7.2	4.7.2
`System.Text.Encodings.Web` NuGet	5.0.0 to 5.0.0	5.0.1
`dotnet` Bitnami	5.0.0 up to 5.0.4	5.0.4
`dotnet-sdk` Bitnami	5.0.0 up to 5.0.4	5.0.4
`System.Text.Encodings.Web` NuGet	4.0.0 up to 4.5.1, plus listed versions 4.0.14.3.04.3.0-preview1-24530-044.3.14.4.0 Show 6 moreShow less 4.4.0-preview1-25305-024.4.0-preview2-25405-014.5.04.5.0-preview1-26216-024.5.0-preview2-26406-044.5.0-rc1	4.5.1
`System.Text.Encodings.Web` NuGet	4.6.0 up to 4.7.2, plus listed versions 4.7.04.7.1	4.7.2
`System.Text.Encodings.Web` NuGet	5.0.0 up to 5.0.1	5.0.1
`rh-dotnet21` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-25.el7_9	0:2.1-25.el7_9
`rh-dotnet21-dotnet` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.522-1.el7_9	0:2.1.522-1.el7_9

Show 74 moreShow less

Affected packages
Package	Affected	Fixed
`rh-dotnet21-dotnet-debuginfo` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.522-1.el7_9	0:2.1.522-1.el7_9
`rh-dotnet21-dotnet-host` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.26-1.el7_9	0:2.1.26-1.el7_9
`rh-dotnet21-dotnet-runtime-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.26-1.el7_9	0:2.1.26-1.el7_9
`rh-dotnet21-dotnet-sdk-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.522-1.el7_9	0:2.1.522-1.el7_9
`rh-dotnet21-dotnet-sdk-2.1.5xx` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.522-1.el7_9	0:2.1.522-1.el7_9
`rh-dotnet21-runtime` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1-25.el7_9	0:2.1-25.el7_9
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`dotnet-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`dotnet-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`dotnet-host-fxr-2.1` Red Hat:enterprise_linux:8::appstream	before 0:2.1.26-1.el8_3	0:2.1.26-1.el8_3
`dotnet-host-fxr-2.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.1.26-1.el8_3	0:2.1.26-1.el8_3
`dotnet-runtime-2.1` Red Hat:enterprise_linux:8::appstream	before 0:2.1.26-1.el8_3	0:2.1.26-1.el8_3
`dotnet-runtime-2.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.1.26-1.el8_3	0:2.1.26-1.el8_3
`dotnet-sdk-2.1` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`dotnet-sdk-2.1.5xx` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`dotnet-sdk-2.1.5xx-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.1.522-1.el8_3	0:2.1.522-1.el8_3
`rh-dotnet31-aspnetcore-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-aspnetcore-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.113-1.el7_9	0:3.1.113-1.el7_9
`rh-dotnet31-dotnet-apphost-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet-debuginfo` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.113-1.el7_9	0:3.1.113-1.el7_9
`rh-dotnet31-dotnet-host` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet-hostfxr-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet-sdk-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.113-1.el7_9	0:3.1.113-1.el7_9
`rh-dotnet31-dotnet-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.13-1.el7_9	0:3.1.13-1.el7_9
`rh-dotnet31-dotnet-templates-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.113-1.el7_9	0:3.1.113-1.el7_9
`rh-dotnet31-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.113-1.el7_9	0:3.1.113-1.el7_9
`aspnetcore-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`aspnetcore-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-apphost-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-apphost-pack-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-hostfxr-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-hostfxr-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-runtime-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-sdk-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`dotnet-sdk-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`dotnet-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.13-1.el8_3	0:3.1.13-1.el8_3
`dotnet-templates-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`dotnet3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`dotnet3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`dotnet3.1-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:3.1.113-1.el8_3	0:3.1.113-1.el8_3
`aspnetcore-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`aspnetcore-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet-apphost-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-apphost-pack-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-host` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-hostfxr-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-hostfxr-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-runtime-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-sdk-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet-sdk-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.4-1.el8_3	0:5.0.4-1.el8_3
`dotnet-templates-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`dotnet5.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream	before 0:5.0.104-1.el8_3	0:5.0.104-1.el8_3
`rh-dotnet50-aspnetcore-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-aspnetcore-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.104-1.el7_9	0:5.0.104-1.el7_9
`rh-dotnet50-dotnet-apphost-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet-debuginfo` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.104-1.el7_9	0:5.0.104-1.el7_9
`rh-dotnet50-dotnet-host` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet-hostfxr-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet-sdk-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.104-1.el7_9	0:5.0.104-1.el7_9
`rh-dotnet50-dotnet-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.4-1.el7_9	0:5.0.4-1.el7_9
`rh-dotnet50-dotnet-templates-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.104-1.el7_9	0:5.0.104-1.el7_9
`rh-dotnet50-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.104-1.el7_9	0:5.0.104-1.el7_9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26701 is a high vulnerability (CVSS 8.1) in Microsoft .net, published February 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.1%, the 98th percentile. Fixed in System.Text.Encodings.Web 4.5.1.

References

Show 27 moreShow less