Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.bcl.memory

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    .NET Denial of Service Vulnerability

    CVE-2026-26127 · GHSA-73j8-2gch-69rq

    Affected
    • NuGet microsoft.bcl.memory >= 9.0.0, <= 9.0.13; >= 10.0.0, <= 10.0.3
    Fixed in
    10.0.49.0.14· Vendor fix available
    Issue
    Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384 CVSS Details - Version: 3.1 - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Severity: High - Weakness: CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read) Affected Platforms - Platforms: All - Architectures: All Affected Products <a name=".NET 9"</a.NET 9 Package name | Affected version | Patched version ------------ | ---------------- |…

    Recommended action: Upgrade to 10.0.4 or 9.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →