{"id":"CVE-2021-26701","aliases":["BIT-dotnet-2021-26701","BIT-dotnet-sdk-2021-26701","EUVD-2021-0826","GHSA-ghhp-997w-qr28","RHSA-2021:0787","RHSA-2021:0788","RHSA-2021:0789","RHSA-2021:0790","RHSA-2021:0793","RHSA-2021:0794"],"status":"published","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.30096,"percentile":0.98229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-02-25T23:02:00Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"NuGet","package":"System.Text.Encodings.Web","fixed_in":["4.5.1","4.7.2","5.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["5.0.4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["5.0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","fixed_in":["0:2.1-25.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","fixed_in":["0:2.1.522-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","fixed_in":["0:2.1.522-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","fixed_in":["0:2.1.26-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","fixed_in":["0:2.1.26-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","fixed_in":["0:2.1.522-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","fixed_in":["0:2.1.522-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","fixed_in":["0:2.1-25.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","fixed_in":["0:2.1.522-1.el8_3","0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debuginfo","fixed_in":["0:2.1.522-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debugsource","fixed_in":["0:2.1.522-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1","fixed_in":["0:2.1.26-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1-debuginfo","fixed_in":["0:2.1.26-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1","fixed_in":["0:2.1.26-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1-debuginfo","fixed_in":["0:2.1.26-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1","fixed_in":["0:2.1.522-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx","fixed_in":["0:2.1.522-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx-debuginfo","fixed_in":["0:2.1.522-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-runtime-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-targeting-pack-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet","fixed_in":["0:3.1.113-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-apphost-pack-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-debuginfo","fixed_in":["0:3.1.113-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-host","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-hostfxr-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-runtime-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1","fixed_in":["0:3.1.113-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-targeting-pack-3.1","fixed_in":["0:3.1.13-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-templates-3.1","fixed_in":["0:3.1.113-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-netstandard-targeting-pack-2.1","fixed_in":["0:3.1.113-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1-debuginfo","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1-debuginfo","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1-debuginfo","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1-debuginfo","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-3.1","fixed_in":["0:3.1.13-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-3.1","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debuginfo","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debugsource","fixed_in":["0:3.1.113-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0-debuginfo","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0-debuginfo","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0-debuginfo","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0-debuginfo","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-5.0","fixed_in":["0:5.0.4-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-5.0","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debuginfo","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debugsource","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netstandard-targeting-pack-2.1","fixed_in":["0:5.0.104-1.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-runtime-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-targeting-pack-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet","fixed_in":["0:5.0.104-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-apphost-pack-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-debuginfo","fixed_in":["0:5.0.104-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-host","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-hostfxr-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-runtime-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0","fixed_in":["0:5.0.104-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-targeting-pack-5.0","fixed_in":["0:5.0.4-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-templates-5.0","fixed_in":["0:5.0.104-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-netstandard-targeting-pack-2.1","fixed_in":["0:5.0.104-1.el7_9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.7.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"fixed":"5.0.1"}]}],"versions":["5.0.0"]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.4"}]}]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}],"versions":["4.0.0","4.0.1","4.3.0","4.3.0-preview1-24530-04","4.3.1","4.4.0","4.4.0-preview1-25305-02","4.4.0-preview2-25405-01","4.5.0","4.5.0-preview1-26216-02","4.5.0-preview2-26406-04","4.5.0-rc1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.7.2"}]}],"versions":["4.6.0","4.7.0","4.7.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.1"}]}],"versions":["5.0.0"]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-25.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-25.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.26-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.522-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-apphost-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-hostfxr-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-templates-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.13-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.113-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-apphost-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-hostfxr-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.4-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-templates-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.104-1.el7_9"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"microsoft","product":".net"},{"vendor":"microsoft","product":".net 5.0"},{"vendor":"microsoft","product":".net core 2.1"},{"vendor":"microsoft","product":".net core 3.1"},{"vendor":"microsoft","product":".net_core"},{"vendor":"microsoft","product":"microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.4 (includes 16.0 - 16.3)"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.7 (includes 16.0 – 16.6)"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.8 (includes 16.0 - 16.7)"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.9 (includes 16.0 - 16.8)"},{"vendor":"microsoft","product":"powershell core 7.0"},{"vendor":"microsoft","product":"powershell core 7.1"},{"vendor":"microsoft","product":"powershell_core"},{"vendor":"microsoft","product":"visual studio 2019 for mac"},{"vendor":"microsoft","product":"visual_studio_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26701","tags":["web","advisory"]},{"url":"https://github.com/dotnet/announcements/issues/178","tags":["web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP/"},{"url":"https://github.com/advisories/GHSA-ghhp-997w-qr28"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0787","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933740","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0787.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26701","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26701","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0788","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0788.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0789","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0789.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0790","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0790.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0793","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0793.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0794","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0794.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-26701","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2021-02-25T23:02:00Z","modified":"2026-05-28T19:31:26.157Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-0826","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2021-02-25T23:02:00Z","modified":"2026-05-28T19:31:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:21:01.680356Z"}],"ghsa":[{"id":"GHSA-ghhp-997w-qr28","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.\n\n### Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.\n\n### Discussion\n\nDiscussion for this issue can be found at dotnet/runtime#49377\n\n### Mitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n### Affected software\n\nThe vulnerable package is `System.Text.Encodings.Web` . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.\n\nVulnerable package versions:\n\nAny .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.\n\nPackage Name | Vulnerable Versions | Secure Versions\n-|-|-\nSystem.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1\nSystem.Text.Encodings.Web |  4.6.0-4.7.1 | 4.7.2\nSystem.Text.Encodings.Web | 5.0.0 |  5.0.1\n\n\nPlease validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.\n\n","status":"published","published":"2021-04-21T19:38:01Z","modified":"2024-01-07T05:05:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2021-26701","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2021-02-25T23:15:16.913Z","modified":"2026-06-17T03:43:40.92Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"CVE-2021-26701","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2021-02-25T23:15:16.913Z","modified":"2026-10-24T10:30:35.972586921Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-ghhp-997w-qr28","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.\n\n### Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.\n\n### Discussion\n\nDiscussion for this issue can be found at dotnet/runtime#49377\n\n### Mitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n### Affected software\n\nThe vulnerable package is `System.Text.Encodings.Web` . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.\n\nVulnerable package versions:\n\nAny .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.\n\nPackage Name | Vulnerable Versions | Secure Versions\n-|-|-\nSystem.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1\nSystem.Text.Encodings.Web |  4.6.0-4.7.1 | 4.7.2\nSystem.Text.Encodings.Web | 5.0.0 |  5.0.1\n\n\nPlease validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.\n\n","status":"published","published":"2021-04-21T19:38:01Z","modified":"2024-12-07T05:45:57.337833Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"RHSA-2021:0787","title":"Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update","status":"published","published":"2025-08-04T10:19:31Z","modified":"2026-06-29T10:34:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0788","title":"Red Hat Security Advisory: dotnet security and bugfix update","status":"published","published":"2025-08-04T10:19:31Z","modified":"2026-06-29T10:34:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0789","title":"Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update","status":"published","published":"2025-08-04T10:19:32Z","modified":"2026-06-29T10:34:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0790","title":"Red Hat Security Advisory: dotnet3.1 security and bugfix update","status":"published","published":"2025-08-04T10:19:32Z","modified":"2026-06-29T10:34:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0793","title":"Red Hat Security Advisory: .NET Core on RHEL 8 security and bugfix update","status":"published","published":"2024-09-13T20:24:17Z","modified":"2026-06-29T10:34:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0794","title":"Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update","status":"published","published":"2024-09-13T20:24:25Z","modified":"2026-06-29T10:34:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"BIT-dotnet-2021-26701","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2024-03-06T10:59:50.664Z","modified":"2026-09-08T08:46:49.103461547Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2021-26701","title":".NET Core Remote Code Execution Vulnerability","description":".NET Core Remote Code Execution Vulnerability","status":"published","published":"2024-03-06T11:00:00.404Z","modified":"2026-09-08T08:46:39.426775644Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}