{"id":"CVE-2026-34043","aliases":["ALSA-2026:21286","ALSA-2026:21291","ALSA-2026:21293","CLSA-2026-1774311647","CLSA-2026-1776213251","CLSA-2026-1776645371","CLSA-2026-1776645372","CLSA-2026-1793790348","CLSA-2026-1793801820","DEBIAN-CVE-2026-34043","EUVD-2026-17288","GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v","RHSA-2026:21286","RHSA-2026:21291","RHSA-2026:21293","RHSA-2026:24332","RHSA-2026:24334","RHSA-2026:24335","RLSA-2026:21286","RLSA-2026:21291","RLSA-2026:21293","ROOT-APP-NPM-CVE-2026-34043","UBUNTU-CVE-2026-34043"],"status":"published","title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00491,"percentile":0.42658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-834"],"published":"2026-03-27T18:18:54Z","modified":"2026-11-04T19:00:36Z","fixes":[{"ecosystem":"npm","package":"serialize-javascript","fixed_in":["7.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"serialize-javascript","fixed_in":["6.0.2-tuxcare.2","5.0.1-tuxcare.2","7.0.4-tuxcare.1","7.0.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-serialize-javascript","fixed_in":["7.0.5+~5.0.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/serialize-javascript","fixed_in":["6.0.2-root.io.3","6.0.2-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"serialize-javascript","fixed_in":["6.0.2-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"7.0.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.1"}]}],"versions":["2.1.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.2"}]}],"versions":["6.0.2","6.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1-tuxcare.0"},{"fixed":"5.0.1-tuxcare.2"}]}],"versions":["5.0.1","5.0.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.4-tuxcare.0"},{"fixed":"7.0.4-tuxcare.1"}]}],"versions":["7.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2-tuxcare.0"},{"fixed":"7.0.2-tuxcare.2"}]}],"versions":["7.0.2","7.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-2","6.0.0-2+deb12u1","6.0.1-1","6.0.2-1","7.0.4+~5.0.4-1","7.0.5+~5.0.4-1","7.0.7+~5.0.4-1","7.1.2+~5.0.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.2-1","7.0.4+~5.0.4-1","7.0.5+~5.0.4-1","7.0.7+~5.0.4-1","7.1.2+~5.0.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5+~5.0.4-1"}]}],"versions":["6.0.2-1","7.0.4+~5.0.4-1"]},{"source":"osv","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"7.0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.27-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-root.io.3"},{"fixed":"6.0.2-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-2","6.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1-1","6.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.4+~5.0.4-1","7.0.5+~5.0.4-1","7.0.7+~5.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.2-1","7.0.4+~5.0.4-1"]}],"products":[{"vendor":"yahoo","product":"serialize"},{"vendor":"yahoo","product":"serialize-javascript"}],"references":[{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","tags":["x_refsource_MISC","Release Notes","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v"},{"url":"https://access.redhat.com/errata/RHSA-2026:21286","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34043","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42899","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453284","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476605","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-21286.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21291","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-21291.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21293","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-21293.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34043.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34043","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476605","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21286.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34043","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42899","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21291.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21293.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24332","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24332.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24334","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24334.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24335","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24335.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21286","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21291","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21293","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34043","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34043","title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T01:48:45.759Z","modified":"2026-03-31T13:55:54.998Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-17288","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T01:48:45Z","modified":"2026-03-31T13:55:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:25.377294Z"}],"ghsa":[{"id":"GHSA-qj8w-gfj5-8c6v","title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","description":"### Impact\n\n**What kind of vulnerability is it?**\n\nIt is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.\n\n**Who is impacted?**\n\nApplications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object.\n\n### Patches\n\n**Has the problem been patched?**\n\nYes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection.\n\n**What versions should users upgrade to?**\n\nUsers should upgrade to **`v7.0.5`** or later.\n\n### Workarounds\n\n**Is there a way for users to fix or remediate the vulnerability without upgrading?**\n\nThere is no direct code-level workaround within the library itself. However, users can mitigate the risk by:\n\n* Validating and sanitizing all input before passing it to the `serialize()` function.\n* Ensuring the environment is protected against Prototype Pollution.\n* Upgrading to **`v7.0.5`** as soon as possible.\n\n### Acknowledgements\n\nSerialize JavaScript thanks **Tomer Aberbach** (@TomerAberbach) for discovering and privately disclosing this issue.","status":"published","published":"2026-03-27T18:18:54Z","modified":"2026-05-21T18:30:15Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2026-34043","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T03:15:58.4Z","modified":"2026-06-17T10:38:28.74Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34043","title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T01:48:45.759Z","modified":"2026-10-28T02:30:35.557966306Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34043","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T03:15:58.4Z","modified":"2026-10-01T03:03:22.730156628Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-qj8w-gfj5-8c6v","title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","description":"### Impact\n\n**What kind of vulnerability is it?**\n\nIt is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.\n\n**Who is impacted?**\n\nApplications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object.\n\n### Patches\n\n**Has the problem been patched?**\n\nYes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection.\n\n**What versions should users upgrade to?**\n\nUsers should upgrade to **`v7.0.5`** or later.\n\n### Workarounds\n\n**Is there a way for users to fix or remediate the vulnerability without upgrading?**\n\nThere is no direct code-level workaround within the library itself. However, users can mitigate the risk by:\n\n* Validating and sanitizing all input before passing it to the `serialize()` function.\n* Ensuring the environment is protected against Prototype Pollution.\n* Upgrading to **`v7.0.5`** as soon as possible.\n\n### Acknowledgements\n\nSerialize JavaScript thanks **Tomer Aberbach** (@TomerAberbach) for discovering and privately disclosing this issue.","status":"published","published":"2026-03-27T18:18:54Z","modified":"2026-09-10T03:50:40.557735802Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"RHSA-2026:21286","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-05-28T10:07:38Z","modified":"2026-10-09T10:22:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21291","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-05-28T10:07:39Z","modified":"2026-10-09T10:22:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21293","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-05-28T10:07:39Z","modified":"2026-10-09T10:22:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24332","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-06-08T10:06:33Z","modified":"2026-10-09T10:23:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24334","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-06-08T10:06:34Z","modified":"2026-10-09T10:23:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24335","title":"Red Hat Security Advisory: .NET 8.0 security update","status":"published","published":"2026-06-08T10:06:35Z","modified":"2026-10-09T10:23:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:21286","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):\n\n* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n\n* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-04T12:04:37.164871Z","modified":"2026-06-04T12:30:17.393904665Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21291","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):\n\n* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n\n* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T00:00:29.215827Z","modified":"2026-05-29T00:30:04.771074022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21293","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):\n\n* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n\n* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-30T18:03:01.190443Z","modified":"2026-05-30T18:25:44.279536137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-34043","description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","status":"published","published":"2026-03-31T03:15:00Z","modified":"2026-10-17T12:58:11.709939465Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:21286","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  \n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  \n\n  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-10-29T11:30:24.442769475Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21291","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  \n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  \n\n  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-10-29T11:02:23.639265383Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21293","title":"Important: .NET 8.0 security update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  \n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  \n\n  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)\n  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-10-29T11:32:33.989588861Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1774311647","title":"TuxCare security update for formidable (4 CVEs)","description":"TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:14Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776213251","title":"TuxCare security update for serialize-javascript (3 CVEs)","description":"TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:25Z","modified":"2026-10-15T09:47:49.782620833Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776645371","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:47:07.491532214Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776645372","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:47:02.812139477Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1793790348","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 7.0.4-tuxcare.1.","status":"published","published":"2026-11-04T12:05:48Z","modified":"2026-11-04T14:45:06.57831163Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793801820","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 7.0.2-tuxcare.2.","status":"published","published":"2026-11-04T15:17:01Z","modified":"2026-11-04T19:00:36.326485525Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"ROOT-APP-NPM-CVE-2026-34043","title":"CVE-2026-34043 in @rootio/serialize-javascript - Patched by Root","description":"Root has patched CVE-2026-34043 in the @rootio/serialize-javascript package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T20:55:33Z","modified":"2026-06-05T01:30:30.141149414Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}