{"id":"CVE-2019-1301","aliases":["EUVD-2019-0655","GHSA-62gw-3rmj-wmp2","RHSA-2019:2731","RHSA-2019:2732"],"status":"published","title":"High severity vulnerability that affects System.Management.Automation","description":"A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05374,"percentile":0.92713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-09-11T21:25:01Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"NuGet","package":"System.Management.Automation","fixed_in":["6.2.3","6.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debuginfo","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debugsource","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1-debuginfo","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1-debuginfo","fixed_in":["0:2.1.13-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx-debuginfo","fixed_in":["0:2.1.509-1.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","fixed_in":["0:2.1-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","fixed_in":["0:2.1.509-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","fixed_in":["0:2.1.509-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","fixed_in":["0:2.1.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","fixed_in":["0:2.1.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","fixed_in":["0:2.1.509-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","fixed_in":["0:2.1.509-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","fixed_in":["0:2.1-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22","fixed_in":["0:2.2-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet","fixed_in":["0:2.2.109-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-debuginfo","fixed_in":["0:2.2.109-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host","fixed_in":["0:2.2.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host-fxr-2.2","fixed_in":["0:2.2.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-runtime-2.2","fixed_in":["0:2.2.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2","fixed_in":["0:2.2.109-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2.1xx","fixed_in":["0:2.2.109-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-runtime","fixed_in":["0:2.2-9.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"System.Management.Automation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Management.Automation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.1.6"}]}]},{"source":"osv","ecosystem":"NuGet","package":"System.Management.Automation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.3"}]}],"versions":["6.2.0","6.2.1","6.2.2"]},{"source":"osv","ecosystem":"NuGet","package":"System.Management.Automation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.1.6"}]}],"versions":["6.0.4","6.0.5","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.509-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.109-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.109-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host-fxr-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-runtime-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.109-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2.1xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.109-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2-9.el7"}]}]}],"products":[{"vendor":"microsoft","product":".net core"},{"vendor":"microsoft","product":".net_core"},{"vendor":"microsoft","product":"powershell_core"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/PowerShell/PowerShell/security/advisories/GHSA-62gw-3rmj-wmp2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1301","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-62gw-3rmj-wmp2","tags":["advisory"]},{"url":"https://github.com/PowerShell/PowerShell","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2731","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1750793","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2731.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1301","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1301","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2732","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2732.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-1301","description":"A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.","status":"published","published":"2019-09-11T21:25:01Z","modified":"2024-08-04T18:13:30.342Z","updated_at":"2026-11-02T14:20:26.034547Z"}],"euvd":[{"id":"EUVD-2019-0655","description":"A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.","status":"published","published":"2019-09-11T21:25:01Z","modified":"2024-08-04T18:13:30Z","updated_at":"2026-11-03T03:06:58.838317Z"}],"ghsa":[{"id":"GHSA-62gw-3rmj-wmp2","title":"High severity vulnerability that affects System.Management.Automation","description":"# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=\u0026labels=Issue-Question\u0026template=Support_Question.md\u0026title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## \u003ca name=\"affected-software\"\u003eAffected Software\u003c/a\u003e\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n\n| PowerShell Core Version | Fixed in          |\n|-------------------------|-------------------|\n| 6.1                     | 6.1.6               |\n| 6.2                     | 6.2.3               |\n| 7.0                     | unaffected               |\n|5                      | unaffected   |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected.  This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)","status":"published","published":"2019-09-13T13:25:47Z","modified":"2025-04-02T22:32:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2019-1301","description":"A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.","status":"published","published":"2019-09-11T22:15:19.023Z","modified":"2026-06-17T02:28:20.173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-1301","description":"A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.","status":"published","published":"2019-09-11T22:15:19.023Z","modified":"2026-10-24T10:30:54.70791469Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"GHSA-62gw-3rmj-wmp2","title":"High severity vulnerability that affects System.Management.Automation","description":"# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=\u0026labels=Issue-Question\u0026template=Support_Question.md\u0026title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## \u003ca name=\"affected-software\"\u003eAffected Software\u003c/a\u003e\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n\n| PowerShell Core Version | Fixed in          |\n|-------------------------|-------------------|\n| 6.1                     | 6.1.6               |\n| 6.2                     | 6.2.3               |\n| 7.0                     | unaffected               |\n|5                      | unaffected   |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected.  This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)","status":"published","published":"2019-09-13T13:25:47Z","modified":"2025-04-02T23:19:14.566005Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RHSA-2019:2731","title":"Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update","status":"published","published":"2024-09-13T19:54:13Z","modified":"2026-06-28T10:31:50Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2732","title":"Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update","status":"published","published":"2024-09-13T19:54:07Z","modified":"2026-06-28T10:31:50Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}