Every CVE Search/ Get API key

CVE-2026-45591

ASP.NET Core Denial of Service Vulnerability

7.5 HighFix available

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.48%Up 0.8 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
CVE-2026-45591
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-35549 7.5

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
EUVD-2026-35549
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-f8h2-vmm9-qhj6 7.5

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR and Blazor Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in the MessagePack hub protocol used by SignalR and Blazor Server where an attacker can send deeply-nested MessagePack arrays to cause a stack overflow, resulting in a denial of service.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/405

Affected Platforms

  • Platforms: All
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.8 | 10.0.9

<a name=".NET 10 SignalR"></a>Microsoft.AspNetCore.SignalR.Protocols.MessagePack (.NET 10)

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.SignalR.Protocols.MessagePack | >= 10.0.0, <= 10.0.8 | 10.0.9

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.16 | 9.0.17 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.16 | 9.0.17 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.16 |…

Record
GHSA-f8h2-vmm9-qhj6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-787
Updated
2026-11-02
NVD 7.5

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
CVE-2026-45591
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-45591 7.5

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
ALPINE-CVE-2026-45591
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVGHSA-f8h2-vmm9-qhj6 7.5

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR and Blazor Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in the MessagePack hub protocol used by SignalR and Blazor Server where an attacker can send deeply-nested MessagePack arrays to cause a stack overflow, resulting in a denial of service.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/405

Affected Platforms

  • Platforms: All
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.8 | 10.0.9 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.8 | 10.0.9

<a name=".NET 10 SignalR"></a>Microsoft.AspNetCore.SignalR.Protocols.MessagePack (.NET 10)

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.SignalR.Protocols.MessagePack | >= 10.0.0, <= 10.0.8 | 10.0.9

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.16 | 9.0.17 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.16 | 9.0.17 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.16 |…

Record
GHSA-f8h2-vmm9-qhj6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-787
Updated
2026-11-02
Show 39 moreShow less
OSVRHSA-2026:17527 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:17527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25110 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:25110
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25111 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:25111
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25112 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record
RHSA-2026:25112
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25113 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record
RHSA-2026:25113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25114 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record
RHSA-2026:25114
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25115 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record
RHSA-2026:25115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25220 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:25220
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25221 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record
RHSA-2026:25221
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25222 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record
RHSA-2026:25222
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:26638 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:26638
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:26994 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:26994
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:28007 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:28007
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:28009 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record
RHSA-2026:28009
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:28011 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:28011
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:28051 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record
RHSA-2026:28051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:28227 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record
RHSA-2026:28227
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25110 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25110
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25111 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25111
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25112 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25112
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25113 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25114 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25114
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25115 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25220 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25220
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25221 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25221
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:25222 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25222
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45591 7.5

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
UBUNTU-CVE-2026-45591
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:25110 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25110
Updated
2026-11-02
OSVALSA-2026:25111 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25111
Updated
2026-11-02
OSVALSA-2026:25112 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25112
Updated
2026-11-02
OSVALSA-2026:25113 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25113
Updated
2026-11-02
OSVALSA-2026:25114 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25114
Updated
2026-11-02
OSVALSA-2026:25115 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25115
Updated
2026-11-02
OSVALSA-2026:25220 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25220
Updated
2026-11-02
OSVALSA-2026:25221 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25221
Updated
2026-11-02
OSVALSA-2026:25222 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

  • dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  • dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25222
Updated
2026-11-02
OSVBIT-aspnet-core-2026-45591 No score

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
BIT-aspnet-core-2026-45591
Updated
2026-11-02
OSVBIT-dotnet-2026-45591 No score

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
BIT-dotnet-2026-45591
Updated
2026-11-02
OSVBIT-dotnet-sdk-2026-45591 No score

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
BIT-dotnet-sdk-2026-45591
Updated
2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 8.0.0 to 8.0.27
8.0.28
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 9.0.0 to 9.0.16
9.0.17
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 10.0.0 to 10.0.8
10.0.9
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 8.0.0 to 8.0.27
8.0.28
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 9.0.0 to 9.0.16
9.0.17
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 10.0.0 to 10.0.8
10.0.9
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 8.0.0 to 8.0.27
8.0.28
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 9.0.0 to 9.0.16
9.0.17
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 10.0.0 to 10.0.8
10.0.9
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 8.0.0 to 8.0.27
8.0.28
Show 290 moreShow less
Affected packages
PackageAffectedFixed
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 9.0.0 to 9.0.16
9.0.17
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 10.0.0 to 10.0.8
10.0.9
dotnet10-runtime
Alpine:v3.23
 before 10.0.9-r0
10.0.9-r0
dotnet10-runtime
Alpine:v3.24
 before 10.0.9-r0
10.0.9-r0
dotnet8-runtime
Alpine:v3.22
 before 8.0.28-r0
8.0.28-r0
dotnet8-runtime
Alpine:v3.23
 before 8.0.28-r0
8.0.28-r0
dotnet8-runtime
Alpine:v3.24
 before 8.0.28-r0
8.0.28-r0
dotnet9-runtime
Alpine:v3.21
 before 9.0.17-r0
9.0.17-r0
dotnet9-runtime
Alpine:v3.22
 before 9.0.17-r0
9.0.17-r0
dotnet9-runtime
Alpine:v3.23
 before 9.0.17-r0
9.0.17-r0
dotnet9-runtime
Alpine:v3.24
 before 9.0.17-r0
9.0.17-r0
aspnetcore-runtime-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
aspnetcore-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
aspnetcore-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-apphost-pack-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-hostfxr-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-runtime-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-sdk-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.128-1.el8_10
8.0.128-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.128-1.el8_10
8.0.128-1.el8_10
dotnet-sdk-dbg-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.128-1.el8_10
8.0.128-1.el8_10
dotnet-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.28-1.el8_10
8.0.28-1.el8_10
dotnet-templates-8.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 8.0.128-1.el8_10
8.0.128-1.el8_10
aspnetcore-runtime-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
aspnetcore-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
aspnetcore-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-apphost-pack-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-hostfxr-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-runtime-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-sdk-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.128-1.el10_2
8.0.128-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.128-1.el10_2
8.0.128-1.el10_2
dotnet-sdk-dbg-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.128-1.el10_2
8.0.128-1.el10_2
dotnet-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.28-1.el10_2
8.0.28-1.el10_2
dotnet-templates-8.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.0.128-1.el10_2
8.0.128-1.el10_2
aspnetcore-runtime-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
aspnetcore-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
aspnetcore-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-apphost-pack-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-hostfxr-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-runtime-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-sdk-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
dotnet-sdk-aot-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
dotnet-sdk-dbg-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
dotnet-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.17-1.el10_2
9.0.17-1.el10_2
dotnet-templates-9.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
netstandard-targeting-pack-2.1
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.0.118-1.el10_2
9.0.118-1.el10_2
aspnetcore-runtime-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
aspnetcore-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
aspnetcore-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-apphost-pack-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-hostfxr-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-runtime-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-sdk-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
dotnet-sdk-aot-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
dotnet-sdk-dbg-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
dotnet-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.17-1.el8_10
9.0.17-1.el8_10
dotnet-templates-9.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
netstandard-targeting-pack-2.1
AlmaLinux:8
From an advisory covering 2 CVEs
 before 9.0.118-1.el8_10
9.0.118-1.el8_10
aspnetcore-runtime-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
aspnetcore-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
aspnetcore-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
dotnet-apphost-pack-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-host
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-hostfxr-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-runtime-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-sdk-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
dotnet-sdk-aot-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
dotnet-sdk-dbg-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
dotnet-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.9-1.el8_10
10.0.9-1.el8_10
dotnet-templates-10.0
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10.0.109-1.el8_10
10.0.109-1.el8_10
aspnetcore-runtime-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
aspnetcore-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
aspnetcore-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-apphost-pack-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-host
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-hostfxr-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-runtime-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-sdk-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.109-1.el10_2
10.0.109-1.el10_2
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.109-1.el10_2
10.0.109-1.el10_2
dotnet-sdk-aot-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.109-1.el10_2
10.0.109-1.el10_2
dotnet-sdk-dbg-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.109-1.el10_2
10.0.109-1.el10_2
dotnet-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.9-1.el10_2
10.0.9-1.el10_2
dotnet-templates-10.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 10.0.109-1.el10_2
10.0.109-1.el10_2
aspnetcore-runtime-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
aspnetcore-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
aspnetcore-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-apphost-pack-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-hostfxr-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-runtime-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-sdk-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.128-1.el9_8
8.0.128-1.el9_8
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.128-1.el9_8
8.0.128-1.el9_8
dotnet-sdk-dbg-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.128-1.el9_8
8.0.128-1.el9_8
dotnet-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.28-1.el9_8
8.0.28-1.el9_8
dotnet-templates-8.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.0.128-1.el9_8
8.0.128-1.el9_8
aspnetcore-runtime-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
aspnetcore-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
aspnetcore-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-apphost-pack-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-hostfxr-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-runtime-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-sdk-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
dotnet-sdk-aot-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
dotnet-sdk-dbg-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
dotnet-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.17-1.el9_8
9.0.17-1.el9_8
dotnet-templates-9.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
netstandard-targeting-pack-2.1
AlmaLinux:9
From an advisory covering 2 CVEs
 before 9.0.118-1.el9_8
9.0.118-1.el9_8
aspnetcore-runtime-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
aspnetcore-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
aspnetcore-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-apphost-pack-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-host
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-hostfxr-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-runtime-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-sdk-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.109-1.el9_8
10.0.109-1.el9_8
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.109-1.el9_8
10.0.109-1.el9_8
dotnet-sdk-aot-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.109-1.el9_8
10.0.109-1.el9_8
dotnet-sdk-dbg-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.109-1.el9_8
10.0.109-1.el9_8
dotnet-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.9-1.el9_8
10.0.9-1.el9_8
dotnet-templates-10.0
AlmaLinux:9
From an advisory covering 2 CVEs
 before 10.0.109-1.el9_8
10.0.109-1.el9_8
aspnet-core
Bitnami
 8.0.0 up to 8.0.28, 9.0.0 up to 9.0.17, 10.0.0 up to 10.0.9
8.0.289.0.1710.0.9
dotnet
Bitnami
 8.0.0 up to 8.0.28, 9.0.0 up to 9.0.17, 10.0.0 up to 10.0.9
8.0.289.0.1710.0.9
dotnet-sdk
Bitnami
 8.0.0 up to 8.0.28, 9.0.0 up to 9.0.17, 10.0.0 up to 10.0.9
8.0.289.0.1710.0.9
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 8.0.0 up to 8.0.28, plus listed versions
8.0.18.0.108.0.118.0.128.0.13
Show 21 moreShow less
8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8
8.0.28
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 9.0.0 up to 9.0.17, plus listed versions
9.0.19.0.109.0.119.0.129.0.13
Show 11 moreShow less
9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.17
Microsoft.AspNetCore.App.Runtime.linux-x64
NuGet
 10.0.0 up to 10.0.9, plus listed versions
10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8
10.0.9
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 8.0.0 up to 8.0.28, plus listed versions
8.0.18.0.108.0.118.0.128.0.13
Show 21 moreShow less
8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8
8.0.28
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 9.0.0 up to 9.0.17, plus listed versions
9.0.19.0.109.0.119.0.129.0.13
Show 11 moreShow less
9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.17
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
 10.0.0 up to 10.0.9, plus listed versions
10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8
10.0.9
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 8.0.0 up to 8.0.28, plus listed versions
8.0.18.0.108.0.118.0.128.0.13
Show 21 moreShow less
8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8
8.0.28
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 9.0.0 up to 9.0.17, plus listed versions
9.0.19.0.109.0.119.0.129.0.13
Show 11 moreShow less
9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.17
Microsoft.AspNetCore.App.Runtime.osx-arm64
NuGet
 10.0.0 up to 10.0.9, plus listed versions
10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8
10.0.9
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 8.0.0 up to 8.0.28, plus listed versions
8.0.18.0.108.0.118.0.128.0.13
Show 21 moreShow less
8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8
8.0.28
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 9.0.0 up to 9.0.17, plus listed versions
9.0.19.0.109.0.119.0.129.0.13
Show 11 moreShow less
9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.17
Microsoft.AspNetCore.SignalR.Protocols.MessagePack
NuGet
 10.0.0 up to 10.0.9, plus listed versions
10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8
10.0.9
dotnet9.0
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:9.0.117-1.hum1
0:9.0.117-1.hum1
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-runtime-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-sdk-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-templates-8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el8_10
0:8.0.28-1.el8_10
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-sdk-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.28-1.el10_2
0:8.0.28-1.el10_2
dotnet-templates-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet8.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-sdk-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el10_2
0:9.0.17-1.el10_2
dotnet-templates-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet9.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-runtime-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-sdk-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-templates-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet9.0-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.17-1.el8_10
0:9.0.17-1.el8_10
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet9.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet9.0-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
aspnetcore-runtime-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
aspnetcore-runtime-dbg-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
aspnetcore-targeting-pack-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-apphost-pack-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-host
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-host-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-hostfxr-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-runtime-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-runtime-dbg-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-sdk-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-aot-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-dbg-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-targeting-pack-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-templates-10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet10.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet10.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet10.0-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-host-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.9-1.el8_10
0:10.0.9-1.el8_10
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-10.0-source-built-artifacts
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet8.0
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el8_10
0:8.0.128-1.el8_10
dotnet8.0
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el10_2
0:8.0.128-1.el10_2
dotnet9.0
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el10_2
0:9.0.118-1.el10_2
dotnet9.0
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el8_10
0:9.0.118-1.el8_10
dotnet10.0
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el8_10
0:10.0.109-1.el8_10
dotnet10.0
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el10_2
0:10.0.109-1.el10_2
dotnet8.0
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:8.0.128-1.el9_8
0:8.0.128-1.el9_8
dotnet9.0
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:9.0.118-1.el9_8
0:9.0.118-1.el9_8
dotnet10.0
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:10.0.109-1.el9_8
0:10.0.109-1.el9_8
dotnet6
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.1
Show 16 moreShow less
6.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.16.0.119-0ubuntu1~22.04.16.0.120-0ubuntu1~22.04.16.0.121-0ubuntu1~22.04.16.0.122-0ubuntu1~22.04.16.0.123-0ubuntu1~22.04.16.0.124-0ubuntu1~22.04.16.0.125-0ubuntu1~22.04.16.0.126-0ubuntu1~22.04.16.0.127-0ubuntu1~22.04.16.0.128-0ubuntu1~22.04.26.0.132-0ubuntu1~22.04.16.0.133-0ubuntu1~22.04.16.0.135-0ubuntu1~22.04.16.0.136-0ubuntu1~22.04.1
 None known
dotnet7
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
 None known
dotnet8
Ubuntu:22.04:LTS
 before 8.0.128-8.0.28-0ubuntu1~22.04.1, plus listed versions
8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1
Show 18 moreShow less
8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.1
8.0.128-8.0.28-0ubuntu1~22.04.1
dotnet10
Ubuntu:24.04:LTS
 before 10.0.109-10.0.9-0ubuntu1~24.04.1, plus listed versions
10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.110.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.1
10.0.109-10.0.9-0ubuntu1~24.04.1
dotnet8
Ubuntu:24.04:LTS
 before 8.0.128-8.0.28-0ubuntu1~24.04.1, plus listed versions
8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2
Show 27 moreShow less
8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.1
8.0.128-8.0.28-0ubuntu1~24.04.1
dotnet10
Ubuntu:25.10
 before 10.0.109-10.0.9-0ubuntu1~25.10.1, plus listed versions
10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu1~25.10.210.0.100-10.0.0-0ubuntu1~25.10.110.0.101-10.0.1-0ubuntu1~25.10.210.0.103-10.0.3-0ubuntu1~25.10.1
Show 5 moreShow less
10.0.104-10.0.4-0ubuntu1~25.10.110.0.105-10.0.5-0ubuntu1~25.10.110.0.106-10.0.6-0ubuntu1~25.10.110.0.107-10.0.7-0ubuntu1~25.10.110.0.108-10.0.8-0ubuntu1~25.10.1
10.0.109-10.0.9-0ubuntu1~25.10.1
dotnet8
Ubuntu:25.10
 before 8.0.128-8.0.28-0ubuntu1~25.10.1, plus listed versions
8.0.115-8.0.15-0ubuntu18.0.116-8.0.16-0ubuntu18.0.117-8.0.17-0ubuntu18.0.118-8.0.18-0ubuntu18.0.119-8.0.19-0ubuntu1
Show 8 moreShow less
8.0.120-8.0.20-0ubuntu18.0.121-8.0.21-0ubuntu1~25.10.18.0.122-8.0.22-0ubuntu1~25.10.18.0.123-8.0.23-0ubuntu1~25.10.18.0.124-8.0.24-0ubuntu1~25.10.18.0.125-8.0.25-0ubuntu1~25.10.18.0.126-8.0.26-0ubuntu1~25.10.18.0.127-8.0.27-0ubuntu1~25.10.1
8.0.128-8.0.28-0ubuntu1~25.10.1
dotnet9
Ubuntu:25.10
 before 9.0.118-9.0.17-0ubuntu1~25.10.1, plus listed versions
9.0.105-9.0.4-0ubuntu19.0.106-9.0.5-0ubuntu19.0.107-9.0.6-0ubuntu19.0.108-9.0.7-0ubuntu19.0.109-9.0.8-0ubuntu1
Show 8 moreShow less
9.0.110-9.0.9-0ubuntu19.0.111-9.0.10-0ubuntu1~25.10.19.0.112-9.0.11-0ubuntu1~25.10.19.0.113-9.0.12-0ubuntu1~25.10.19.0.114-9.0.13-0ubuntu1~25.10.19.0.115-9.0.14-0ubuntu1~25.10.19.0.116-9.0.15-0ubuntu1~25.10.19.0.117-9.0.16-0ubuntu1~25.10.1
9.0.118-9.0.17-0ubuntu1~25.10.1
dotnet10
Ubuntu:26.10
 before 10.0.109-10.0.9-0ubuntu1, plus listed versions
10.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1
10.0.109-10.0.9-0ubuntu1
dotnet10
Ubuntu:26.04:LTS
 before 10.0.109-10.0.9-0ubuntu1~26.04.1, plus listed versions
10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1
Show 8 moreShow less
10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.1
10.0.109-10.0.9-0ubuntu1~26.04.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45591 is a high vulnerability (CVSS 7.5) in Microsoft .net, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in Microsoft.AspNetCore.App.Runtime.linux-x64 8.0.28.

References

Show 166 moreShow less
This page doesn't list everything

Left out here: 239 package rows and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open