High, CVSS 7.5NuGetPublished
EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory
GHSA-32wq-ppwg-3w4m
- Affected
- NuGet enhancedlinq.async >= 1.0.0-beta.1, < 1.0.0-beta.3
- Fixed in
- 1.0.0-beta.3· Vendor fix available
- Issue
- Impact Microsoft.Bcl.Memory, a transitive dependency of EnhancedLinq.Async, had a Denial of Service security vulnerability, CVE-2026-26127, thus affecting EnhancedLinq.Async versions that had vulnerable versions of Microsoft.Bcl.Memory as a transitive dependency. Patches EnhancedLinq.Async 1.0.0 Beta 3 updates the dependency on System.Linq.AsyncEnumerable to version 10.0.4 or newer which in turn updates the transitive dependency on Microsoft.Bcl.Memory from version 10.0.3 to 10.0.4 or newer, resolving the vulnerability. Workarounds No workarounds exist for this vulnerability. How to fix the issue To update the EnhancedLinq.Async NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: - Open the project in Visual Studio. - Right-click on the project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with…
Recommended action: Upgrade to 1.0.0-beta.3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.