Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.extensions.validation

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetAmendedPublished

    Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability

    CVE-2026-118749 · GHSA-m28h-pj36-4364

    Affected
    • NuGet microsoft.extensions.validation >= 11.0.0-rc.1.26425.128, < 11.0.0
    Fixed in
    11.0.0· Vendor fix available
    Issue
    Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - Weakness: CWE-407 Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately. .NET 11.0 - affected runtime packages Package | Affected version | Patched…

    Recommended action: Upgrade to 11.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →