CVE-2021-26423

.NET Core and Visual Studio Denial of Service Vulnerability

7.5 HighFix available

.NET Core and Visual Studio Denial of Service Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.90%Up 3.4 points since Aug 13, 2021

What each source reports

CVE List Score used 7.5

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-26423
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

EUVDEUVD-2022-7160 7.5

.NET Core and Visual Studio Denial of Service Vulnerability

Record: EUVD-2022-7160
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rh58-r7jh-xhx3 7.5

.NET Core Elevation of Privilege Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.

Patches

If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.

Other Details

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/194
An Issue for this can be found at https://github.com/dotnet/runtime/issues/57175
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26423

Record: GHSA-rh58-r7jh-xhx3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.5

.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-26423
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSV 7.5

.NET Core and Visual Studio Denial of Service Vulnerability

Record: CVE-2021-26423
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-rh58-r7jh-xhx3 7.5

.NET Core Elevation of Privilege Vulnerability

Patches

If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.

Other Details

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/194
An Issue for this can be found at https://github.com/dotnet/runtime/issues/57175
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26423

Record: GHSA-rh58-r7jh-xhx3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVRHSA-2021:3142 7.5

Red Hat Security Advisory: .NET Core 3.1 security and bugfix update

Record: RHSA-2021:3142
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:3143 7.5

Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update

Record: RHSA-2021:3143
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:3147 7.5

Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update

Record: RHSA-2021:3147
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2021:3148 7.5

Red Hat Security Advisory: .NET 5.0 security and bugfix update

Record: RHSA-2021:3148
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-dotnet-2021-26423 No score

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Record: BIT-dotnet-2021-26423
Updated: 2026-11-02

OSVBIT-dotnet-sdk-2021-26423 No score

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Record: BIT-dotnet-sdk-2021-26423
Updated: 2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.NETCore.App.Runtime.win-x86` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.win-x86` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.win-arm64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.win-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.win-arm` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.win-arm` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.osx-x64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.osx-x64` NuGet	5.0.0 up to 5.0.9	5.0.9

Show 116 moreShow less

Affected packages
Package	Affected	Fixed
`Microsoft.NETCore.App.Runtime.Mono.osx-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-arm` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-x64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-musl-x64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-arm64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-musl-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-arm` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.rhel.6-x64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm64` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm64` NuGet	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.linux-arm` NuGet	3.1.0 up to 3.1.18	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm` NuGet	5.0.0 up to 5.0.9	5.0.9
`dotnet` Bitnami	5.0.0 up to 5.0.9	5.0.9
`dotnet-sdk` Bitnami	5.0.0 up to 5.0.9	5.0.9
`Microsoft.NETCore.App.Runtime.win-x86` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.win-x86` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.win-arm64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.win-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.win-arm` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.win-arm` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.osx-x64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.osx-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.osx-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.Mono.linux-arm` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-x64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-musl-x64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-arm64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-musl-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.linux-musl-arm` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.rhel.6-x64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm64` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm64` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`Microsoft.NETCore.App.Runtime.linux-arm` NuGet	3.1.0 up to 3.1.18, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 12 moreShow less 3.1.143.1.153.1.163.1.173.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.18
`Microsoft.NETCore.App.Runtime.linux-arm` NuGet	5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8	5.0.9
`aspnetcore-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`aspnetcore-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-apphost-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-apphost-pack-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-hostfxr-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-hostfxr-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-runtime-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-runtime-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-sdk-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`dotnet-sdk-3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`dotnet-targeting-pack-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.18-1.el8_4	0:3.1.18-1.el8_4
`dotnet-templates-3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`dotnet3.1` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`dotnet3.1-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`dotnet3.1-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:3.1.118-1.el8_4	0:3.1.118-1.el8_4
`rh-dotnet31-aspnetcore-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-aspnetcore-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.118-1.el7_9	0:3.1.118-1.el7_9
`rh-dotnet31-dotnet-apphost-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet-debuginfo` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.118-1.el7_9	0:3.1.118-1.el7_9
`rh-dotnet31-dotnet-host` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet-hostfxr-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet-runtime-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet-sdk-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.118-1.el7_9	0:3.1.118-1.el7_9
`rh-dotnet31-dotnet-targeting-pack-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.18-1.el7_9	0:3.1.18-1.el7_9
`rh-dotnet31-dotnet-templates-3.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.118-1.el7_9	0:3.1.118-1.el7_9
`rh-dotnet31-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:3.1::el7	before 0:3.1.118-1.el7_9	0:3.1.118-1.el7_9
`rh-dotnet50-aspnetcore-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-aspnetcore-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.206-1.el7_9	0:5.0.206-1.el7_9
`rh-dotnet50-dotnet-apphost-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet-debuginfo` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.206-1.el7_9	0:5.0.206-1.el7_9
`rh-dotnet50-dotnet-host` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet-hostfxr-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet-runtime-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet-sdk-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.206-1.el7_9	0:5.0.206-1.el7_9
`rh-dotnet50-dotnet-targeting-pack-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.9-1.el7_9	0:5.0.9-1.el7_9
`rh-dotnet50-dotnet-templates-5.0` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.206-1.el7_9	0:5.0.206-1.el7_9
`rh-dotnet50-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:5.0::el7	before 0:5.0.206-1.el7_9	0:5.0.206-1.el7_9
`aspnetcore-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`aspnetcore-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet-apphost-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-apphost-pack-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-host` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-hostfxr-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-hostfxr-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-runtime-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-runtime-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-sdk-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet-sdk-5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet-targeting-pack-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.9-1.el8_4	0:5.0.9-1.el8_4
`dotnet-templates-5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet5.0` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet5.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`dotnet5.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream	before 0:5.0.206-1.el8_4	0:5.0.206-1.el8_4

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26423 is a high vulnerability (CVSS 7.5) in Microsoft .net, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.90%, the 90th percentile. Fixed in Microsoft.NETCore.App.Runtime.win-x86 3.1.18.

References

Show 24 moreShow less