CVE-2026-45491

.NET Tampering Vulnerability

6.2 MediumFix available

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.39%Up 0.3 points since Jun 10, 2026

What each source reports

CVE List Score used 6.2

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: CVE-2026-45491
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Weakness: CWE-59
Updated: 2026-11-02

EUVDEUVD-2026-35675 6.2

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: EUVD-2026-35675
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7q4v-2mr6-5gpx 6.8

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Formats.Tar. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A tampering vulnerability exists in the TarFile.ExtractToDirectory method where a symlink path traversal enables an attacker to perform arbitrary file writes outside the intended extraction directory.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/404

Affected Platforms

Platforms: All
Architectures: All

Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 10.0.0, <= 10.0.8 | 10.0.9

.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 9.0.0, <= 9.0.16 | 9.0.17

.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 8.0.0, <= 8.0.27 | 8.0.28

Advisory FAQ

How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue please install the latest version of .NET 8.0, .NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
If your application references the vulnerable package, update the package reference to the patched version.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of…

Record: GHSA-7q4v-2mr6-5gpx
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-59
Updated: 2026-11-02

NVD 6.2

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: CVE-2026-45491
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSVALPINE-CVE-2026-45491 5.5

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: ALPINE-CVE-2026-45491
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-03

OSVGHSA-7q4v-2mr6-5gpx 6.8

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Executive Summary

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/404

Affected Platforms

Platforms: All
Architectures: All

Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 10.0.0, <= 10.0.8 | 10.0.9

.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 9.0.0, <= 9.0.16 | 9.0.17

.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime | >= 8.0.0, <= 8.0.27 | 8.0.28

Advisory FAQ

How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue please install the latest version of .NET 8.0, .NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
If your application references the vulnerable package, update the package reference to the patched version.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

Disclaimer

Record: GHSA-7q4v-2mr6-5gpx
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-59
Updated: 2026-11-02

Show 39 moreShow less

OSVRHSA-2026:17527 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:17527
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25110 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:25110
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25111 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:25111
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25112 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record: RHSA-2026:25112
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25113 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record: RHSA-2026:25113
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25114 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record: RHSA-2026:25114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25115 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record: RHSA-2026:25115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25220 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:25220
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25221 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record: RHSA-2026:25221
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:25222 7.5

Red Hat Security Advisory: .NET 10.0 security update

Record: RHSA-2026:25222
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:26638 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:26638
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:26994 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:26994
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:28007 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:28007
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:28009 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record: RHSA-2026:28009
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:28011 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:28011
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:28051 7.5

Red Hat Security Advisory: .NET 9.0 security update

Record: RHSA-2026:28051
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:28227 7.5

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2026:28227
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25110 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25110
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25111 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25111
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25112 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25112
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25113 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25113
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25114 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25115 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25220 7.5

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25220
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25221 7.5

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25221
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25222 7.5

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25222
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-45491 6.2

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: UBUNTU-CVE-2026-45491
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVALSA-2026:25110 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25110
Updated: 2026-11-02

OSVALSA-2026:25111 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25111
Updated: 2026-11-02

OSVALSA-2026:25112 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25112
Updated: 2026-11-02

OSVALSA-2026:25113 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25113
Updated: 2026-11-02

OSVALSA-2026:25114 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25114
Updated: 2026-11-02

OSVALSA-2026:25115 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25115
Updated: 2026-11-02

OSVALSA-2026:25220 No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25220
Updated: 2026-11-02

OSVALSA-2026:25221 No score

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25221
Updated: 2026-11-02

OSVALSA-2026:25222 No score

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:25222
Updated: 2026-11-02

OSVBIT-dotnet-2026-45491 No score

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: BIT-dotnet-2026-45491
Updated: 2026-11-02

OSVBIT-dotnet-sdk-2026-45491 No score

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Record: BIT-dotnet-sdk-2026-45491
Updated: 2026-11-02

OSVUSN-8420-1 No score

dotnet8, dotnet9, dotnet10 vulnerabilities

It was discovered that .NET did not properly handle link resolution before file access. A local attacker could use this issue to perform unauthorized file tampering and write arbitrary files outside of the intended extraction directory. (CVE-2026-45491)

It was discovered that .NET did not properly handle deeply-nested MessagePack arrays. An attacker could use this to cause .NET to consume excessive resources, resulting in a denial of service. (CVE-2026-45591)

Record: USN-8420-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	8.0.0 to 8.0.27	8.0.28
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	9.0.0 to 9.0.16	9.0.17
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	10.0.0 to 10.0.8	10.0.9
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	8.0.0 to 8.0.27	8.0.28
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	9.0.0 to 9.0.16	9.0.17
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	10.0.0 to 10.0.8	10.0.9
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	8.0.0 to 8.0.27	8.0.28
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	9.0.0 to 9.0.16	9.0.17
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	10.0.0 to 10.0.8	10.0.9
`dotnet10-runtime` Alpine:v3.23	before 10.0.9-r0	10.0.9-r0

Show 290 moreShow less

Affected packages
Package	Affected	Fixed
`dotnet10-runtime` Alpine:v3.24	before 10.0.9-r0	10.0.9-r0
`dotnet8-runtime` Alpine:v3.22	before 8.0.28-r0	8.0.28-r0
`dotnet8-runtime` Alpine:v3.23	before 8.0.28-r0	8.0.28-r0
`dotnet8-runtime` Alpine:v3.24	before 8.0.28-r0	8.0.28-r0
`dotnet9-runtime` Alpine:v3.21	before 9.0.17-r0	9.0.17-r0
`dotnet9-runtime` Alpine:v3.22	before 9.0.17-r0	9.0.17-r0
`dotnet9-runtime` Alpine:v3.23	before 9.0.17-r0	9.0.17-r0
`dotnet9-runtime` Alpine:v3.24	before 9.0.17-r0	9.0.17-r0
`aspnetcore-runtime-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`aspnetcore-runtime-dbg-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`aspnetcore-targeting-pack-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-apphost-pack-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-hostfxr-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-runtime-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-runtime-dbg-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-sdk-8.0` AlmaLinux:8	before 8.0.128-1.el8_10	8.0.128-1.el8_10
`dotnet-sdk-8.0-source-built-artifacts` AlmaLinux:8	before 8.0.128-1.el8_10	8.0.128-1.el8_10
`dotnet-sdk-dbg-8.0` AlmaLinux:8	before 8.0.128-1.el8_10	8.0.128-1.el8_10
`dotnet-targeting-pack-8.0` AlmaLinux:8	before 8.0.28-1.el8_10	8.0.28-1.el8_10
`dotnet-templates-8.0` AlmaLinux:8	before 8.0.128-1.el8_10	8.0.128-1.el8_10
`aspnetcore-runtime-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`aspnetcore-runtime-dbg-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`aspnetcore-targeting-pack-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-apphost-pack-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-hostfxr-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-runtime-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-runtime-dbg-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-sdk-8.0` AlmaLinux:10	before 8.0.128-1.el10_2	8.0.128-1.el10_2
`dotnet-sdk-8.0-source-built-artifacts` AlmaLinux:10	before 8.0.128-1.el10_2	8.0.128-1.el10_2
`dotnet-sdk-dbg-8.0` AlmaLinux:10	before 8.0.128-1.el10_2	8.0.128-1.el10_2
`dotnet-targeting-pack-8.0` AlmaLinux:10	before 8.0.28-1.el10_2	8.0.28-1.el10_2
`dotnet-templates-8.0` AlmaLinux:10	before 8.0.128-1.el10_2	8.0.128-1.el10_2
`aspnetcore-runtime-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`aspnetcore-runtime-dbg-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`aspnetcore-targeting-pack-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-apphost-pack-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-hostfxr-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-runtime-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-runtime-dbg-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-sdk-9.0` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`dotnet-sdk-9.0-source-built-artifacts` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`dotnet-sdk-aot-9.0` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`dotnet-sdk-dbg-9.0` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`dotnet-targeting-pack-9.0` AlmaLinux:10	before 9.0.17-1.el10_2	9.0.17-1.el10_2
`dotnet-templates-9.0` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`netstandard-targeting-pack-2.1` AlmaLinux:10	before 9.0.118-1.el10_2	9.0.118-1.el10_2
`aspnetcore-runtime-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`aspnetcore-runtime-dbg-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`aspnetcore-targeting-pack-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-apphost-pack-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-hostfxr-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-runtime-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-runtime-dbg-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-sdk-9.0` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`dotnet-sdk-9.0-source-built-artifacts` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`dotnet-sdk-aot-9.0` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`dotnet-sdk-dbg-9.0` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`dotnet-targeting-pack-9.0` AlmaLinux:8	before 9.0.17-1.el8_10	9.0.17-1.el8_10
`dotnet-templates-9.0` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`netstandard-targeting-pack-2.1` AlmaLinux:8	before 9.0.118-1.el8_10	9.0.118-1.el8_10
`aspnetcore-runtime-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`aspnetcore-runtime-dbg-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`aspnetcore-targeting-pack-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`dotnet-apphost-pack-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-host` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-hostfxr-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-runtime-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-runtime-dbg-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-sdk-10.0` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`dotnet-sdk-10.0-source-built-artifacts` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`dotnet-sdk-aot-10.0` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`dotnet-sdk-dbg-10.0` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`dotnet-targeting-pack-10.0` AlmaLinux:8	before 10.0.9-1.el8_10	10.0.9-1.el8_10
`dotnet-templates-10.0` AlmaLinux:8	before 10.0.109-1.el8_10	10.0.109-1.el8_10
`aspnetcore-runtime-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`aspnetcore-runtime-dbg-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`aspnetcore-targeting-pack-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-apphost-pack-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-host` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-hostfxr-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-runtime-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-runtime-dbg-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-sdk-10.0` AlmaLinux:10	before 10.0.109-1.el10_2	10.0.109-1.el10_2
`dotnet-sdk-10.0-source-built-artifacts` AlmaLinux:10	before 10.0.109-1.el10_2	10.0.109-1.el10_2
`dotnet-sdk-aot-10.0` AlmaLinux:10	before 10.0.109-1.el10_2	10.0.109-1.el10_2
`dotnet-sdk-dbg-10.0` AlmaLinux:10	before 10.0.109-1.el10_2	10.0.109-1.el10_2
`dotnet-targeting-pack-10.0` AlmaLinux:10	before 10.0.9-1.el10_2	10.0.9-1.el10_2
`dotnet-templates-10.0` AlmaLinux:10	before 10.0.109-1.el10_2	10.0.109-1.el10_2
`aspnetcore-runtime-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`aspnetcore-runtime-dbg-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`aspnetcore-targeting-pack-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-apphost-pack-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-hostfxr-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-runtime-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-runtime-dbg-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-sdk-8.0` AlmaLinux:9	before 8.0.128-1.el9_8	8.0.128-1.el9_8
`dotnet-sdk-8.0-source-built-artifacts` AlmaLinux:9	before 8.0.128-1.el9_8	8.0.128-1.el9_8
`dotnet-sdk-dbg-8.0` AlmaLinux:9	before 8.0.128-1.el9_8	8.0.128-1.el9_8
`dotnet-targeting-pack-8.0` AlmaLinux:9	before 8.0.28-1.el9_8	8.0.28-1.el9_8
`dotnet-templates-8.0` AlmaLinux:9	before 8.0.128-1.el9_8	8.0.128-1.el9_8
`aspnetcore-runtime-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`aspnetcore-runtime-dbg-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`aspnetcore-targeting-pack-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-apphost-pack-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-hostfxr-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-runtime-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-runtime-dbg-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-sdk-9.0` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`dotnet-sdk-9.0-source-built-artifacts` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`dotnet-sdk-aot-9.0` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`dotnet-sdk-dbg-9.0` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`dotnet-targeting-pack-9.0` AlmaLinux:9	before 9.0.17-1.el9_8	9.0.17-1.el9_8
`dotnet-templates-9.0` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`netstandard-targeting-pack-2.1` AlmaLinux:9	before 9.0.118-1.el9_8	9.0.118-1.el9_8
`aspnetcore-runtime-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`aspnetcore-runtime-dbg-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`aspnetcore-targeting-pack-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-apphost-pack-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-host` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-hostfxr-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-runtime-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-runtime-dbg-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-sdk-10.0` AlmaLinux:9	before 10.0.109-1.el9_8	10.0.109-1.el9_8
`dotnet-sdk-10.0-source-built-artifacts` AlmaLinux:9	before 10.0.109-1.el9_8	10.0.109-1.el9_8
`dotnet-sdk-aot-10.0` AlmaLinux:9	before 10.0.109-1.el9_8	10.0.109-1.el9_8
`dotnet-sdk-dbg-10.0` AlmaLinux:9	before 10.0.109-1.el9_8	10.0.109-1.el9_8
`dotnet-targeting-pack-10.0` AlmaLinux:9	before 10.0.9-1.el9_8	10.0.9-1.el9_8
`dotnet-templates-10.0` AlmaLinux:9	before 10.0.109-1.el9_8	10.0.109-1.el9_8
`dotnet` Bitnami	8.0.0 up to 8.0.28, 9.0.0 up to 9.0.17, 10.0.0 up to 10.0.9	8.0.289.0.1710.0.9
`dotnet-sdk` Bitnami	8.0.0 up to 8.0.28, 9.0.0 up to 9.0.17, 10.0.0 up to 10.0.9	8.0.289.0.1710.0.9
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	8.0.0 up to 8.0.28, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 21 moreShow less 8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8	8.0.28
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	9.0.0 up to 9.0.17, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 11 moreShow less 9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9	9.0.17
`Microsoft.NETCore.App.Runtime.linux-x64` NuGet	10.0.0 up to 10.0.9, plus listed versions 10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8	10.0.9
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	8.0.0 up to 8.0.28, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 21 moreShow less 8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8	8.0.28
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	9.0.0 up to 9.0.17, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 11 moreShow less 9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9	9.0.17
`Microsoft.NETCore.App.Runtime.win-x64` NuGet	10.0.0 up to 10.0.9, plus listed versions 10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8	10.0.9
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	8.0.0 up to 8.0.28, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 21 moreShow less 8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.38.0.48.0.58.0.68.0.78.0.8	8.0.28
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	9.0.0 up to 9.0.17, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 11 moreShow less 9.0.149.0.159.0.169.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9	9.0.17
`Microsoft.NETCore.App.Runtime.osx-arm64` NuGet	10.0.0 up to 10.0.9, plus listed versions 10.0.110.0.210.0.310.0.410.0.510.0.610.0.710.0.8	10.0.9
`dotnet9.0` Red Hat:hummingbird:1	before 0:9.0.117-1.hum1	0:9.0.117-1.hum1
`aspnetcore-runtime-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`aspnetcore-runtime-dbg-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`aspnetcore-targeting-pack-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-apphost-pack-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-hostfxr-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-runtime-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-runtime-dbg-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-sdk-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet-sdk-dbg-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet-targeting-pack-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-templates-8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:8.0.28-1.el8_10	0:8.0.28-1.el8_10
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet-sdk-8.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0-debugsource` Red Hat:enterprise_linux:8::crb	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`aspnetcore-runtime-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`aspnetcore-runtime-dbg-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`aspnetcore-targeting-pack-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-apphost-pack-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-hostfxr-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-runtime-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-runtime-dbg-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-sdk-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet-sdk-dbg-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet-targeting-pack-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.28-1.el10_2	0:8.0.28-1.el10_2
`dotnet-templates-8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet8.0` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet8.0-debugsource` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet-sdk-8.0-source-built-artifacts` Red Hat:enterprise_linux:10.2	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`aspnetcore-runtime-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`aspnetcore-runtime-dbg-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`aspnetcore-targeting-pack-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-apphost-pack-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-apphost-pack-9.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-hostfxr-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-hostfxr-9.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-runtime-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-runtime-9.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-runtime-dbg-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-sdk-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-sdk-9.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-sdk-aot-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-sdk-aot-9.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-sdk-dbg-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-targeting-pack-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.17-1.el10_2	0:9.0.17-1.el10_2
`dotnet-templates-9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet9.0` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet9.0-debugsource` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet-sdk-9.0-source-built-artifacts` Red Hat:enterprise_linux:10.2	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`aspnetcore-runtime-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`aspnetcore-runtime-dbg-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`aspnetcore-targeting-pack-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-apphost-pack-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-apphost-pack-9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-hostfxr-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-hostfxr-9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-runtime-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-runtime-9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-runtime-dbg-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-sdk-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-aot-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-aot-9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-dbg-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-targeting-pack-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-templates-9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet9.0` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet9.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet9.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-apphost-pack-9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-hostfxr-9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-runtime-9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.17-1.el8_10	0:9.0.17-1.el8_10
`dotnet-sdk-9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-9.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet-sdk-aot-9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet9.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet9.0-debugsource` Red Hat:enterprise_linux:8::crb	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`aspnetcore-runtime-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`aspnetcore-runtime-dbg-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`aspnetcore-targeting-pack-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-apphost-pack-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-apphost-pack-10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-host` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-hostfxr-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-hostfxr-10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-runtime-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-runtime-10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-runtime-dbg-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-sdk-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-aot-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-aot-10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-dbg-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-targeting-pack-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-templates-10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-apphost-pack-10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-hostfxr-10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-runtime-10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.9-1.el8_10	0:10.0.9-1.el8_10
`dotnet-sdk-10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-10.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet-sdk-aot-10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0-debugsource` Red Hat:enterprise_linux:8::crb	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`aspnetcore-runtime-10.0` Red Hat:enterprise_linux:10.2	before 0:10.0.9-1.el10_2	0:10.0.9-1.el10_2
`aspnetcore-runtime-dbg-10.0` Red Hat:enterprise_linux:10.2	before 0:10.0.9-1.el10_2	0:10.0.9-1.el10_2
`aspnetcore-targeting-pack-10.0` Red Hat:enterprise_linux:10.2	before 0:10.0.9-1.el10_2	0:10.0.9-1.el10_2
`dotnet-apphost-pack-10.0` Red Hat:enterprise_linux:10.2	before 0:10.0.9-1.el10_2	0:10.0.9-1.el10_2
`dotnet-apphost-pack-10.0-debuginfo` Red Hat:enterprise_linux:10.2	before 0:10.0.9-1.el10_2	0:10.0.9-1.el10_2
`dotnet8.0` Rocky Linux:8	before 0:8.0.128-1.el8_10	0:8.0.128-1.el8_10
`dotnet8.0` Rocky Linux:10	before 0:8.0.128-1.el10_2	0:8.0.128-1.el10_2
`dotnet9.0` Rocky Linux:10	before 0:9.0.118-1.el10_2	0:9.0.118-1.el10_2
`dotnet9.0` Rocky Linux:8	before 0:9.0.118-1.el8_10	0:9.0.118-1.el8_10
`dotnet10.0` Rocky Linux:8	before 0:10.0.109-1.el8_10	0:10.0.109-1.el8_10
`dotnet10.0` Rocky Linux:10	before 0:10.0.109-1.el10_2	0:10.0.109-1.el10_2
`dotnet8.0` Rocky Linux:9	before 0:8.0.128-1.el9_8	0:8.0.128-1.el9_8
`dotnet9.0` Rocky Linux:9	before 0:9.0.118-1.el9_8	0:9.0.118-1.el9_8
`dotnet10.0` Rocky Linux:9	before 0:10.0.109-1.el9_8	0:10.0.109-1.el9_8
`dotnet6` Ubuntu:22.04:LTS	All versions, plus listed versions 6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.1 Show 16 moreShow less 6.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.16.0.119-0ubuntu1~22.04.16.0.120-0ubuntu1~22.04.16.0.121-0ubuntu1~22.04.16.0.122-0ubuntu1~22.04.16.0.123-0ubuntu1~22.04.16.0.124-0ubuntu1~22.04.16.0.125-0ubuntu1~22.04.16.0.126-0ubuntu1~22.04.16.0.127-0ubuntu1~22.04.16.0.128-0ubuntu1~22.04.26.0.132-0ubuntu1~22.04.16.0.133-0ubuntu1~22.04.16.0.135-0ubuntu1~22.04.16.0.136-0ubuntu1~22.04.1	None known
`dotnet7` Ubuntu:22.04:LTS	All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less 7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1	None known
`dotnet8` Ubuntu:22.04:LTS	before 8.0.128-8.0.28-0ubuntu1~22.04.1, plus listed versions 8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1 Show 18 moreShow less 8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.1	8.0.128-8.0.28-0ubuntu1~22.04.1
`dotnet10` Ubuntu:24.04:LTS	before 10.0.109-10.0.9-0ubuntu1~24.04.1, plus listed versions 10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.110.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.1	10.0.109-10.0.9-0ubuntu1~24.04.1
`dotnet8` Ubuntu:24.04:LTS	before 8.0.128-8.0.28-0ubuntu1~24.04.1, plus listed versions 8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2 Show 27 moreShow less 8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.1	8.0.128-8.0.28-0ubuntu1~24.04.1
`dotnet10` Ubuntu:25.10	before 10.0.109-10.0.9-0ubuntu1~25.10.1, plus listed versions 10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu1~25.10.210.0.100-10.0.0-0ubuntu1~25.10.110.0.101-10.0.1-0ubuntu1~25.10.210.0.103-10.0.3-0ubuntu1~25.10.1 Show 5 moreShow less 10.0.104-10.0.4-0ubuntu1~25.10.110.0.105-10.0.5-0ubuntu1~25.10.110.0.106-10.0.6-0ubuntu1~25.10.110.0.107-10.0.7-0ubuntu1~25.10.110.0.108-10.0.8-0ubuntu1~25.10.1	10.0.109-10.0.9-0ubuntu1~25.10.1
`dotnet8` Ubuntu:25.10	before 8.0.128-8.0.28-0ubuntu1~25.10.1, plus listed versions 8.0.115-8.0.15-0ubuntu18.0.116-8.0.16-0ubuntu18.0.117-8.0.17-0ubuntu18.0.118-8.0.18-0ubuntu18.0.119-8.0.19-0ubuntu1 Show 8 moreShow less 8.0.120-8.0.20-0ubuntu18.0.121-8.0.21-0ubuntu1~25.10.18.0.122-8.0.22-0ubuntu1~25.10.18.0.123-8.0.23-0ubuntu1~25.10.18.0.124-8.0.24-0ubuntu1~25.10.18.0.125-8.0.25-0ubuntu1~25.10.18.0.126-8.0.26-0ubuntu1~25.10.18.0.127-8.0.27-0ubuntu1~25.10.1	8.0.128-8.0.28-0ubuntu1~25.10.1
`dotnet9` Ubuntu:25.10	before 9.0.118-9.0.17-0ubuntu1~25.10.1, plus listed versions 9.0.105-9.0.4-0ubuntu19.0.106-9.0.5-0ubuntu19.0.107-9.0.6-0ubuntu19.0.108-9.0.7-0ubuntu19.0.109-9.0.8-0ubuntu1 Show 8 moreShow less 9.0.110-9.0.9-0ubuntu19.0.111-9.0.10-0ubuntu1~25.10.19.0.112-9.0.11-0ubuntu1~25.10.19.0.113-9.0.12-0ubuntu1~25.10.19.0.114-9.0.13-0ubuntu1~25.10.19.0.115-9.0.14-0ubuntu1~25.10.19.0.116-9.0.15-0ubuntu1~25.10.19.0.117-9.0.16-0ubuntu1~25.10.1	9.0.118-9.0.17-0ubuntu1~25.10.1
`dotnet10` Ubuntu:26.10	before 10.0.109-10.0.9-0ubuntu1, plus listed versions 10.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1	10.0.109-10.0.9-0ubuntu1
`dotnet10` Ubuntu:26.04:LTS	before 10.0.109-10.0.9-0ubuntu1~26.04.1, plus listed versions 10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1 Show 8 moreShow less 10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.1	10.0.109-10.0.9-0ubuntu1~26.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45491 is a medium vulnerability (CVSS 6.2) in Microsoft .net, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in Microsoft.NETCore.App.Runtime.linux-x64 8.0.28.

References

Show 165 moreShow less

This page doesn't list everything

Left out here: 232 package rows and the rest of 2 source descriptions. The JSON record has them.