Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
42 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SocketsHttpHandler can retain a Proxy-Authorization header across an HTTP redirect and leak basic proxy credentials to the destination server. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/448 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 5.9 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness: CWE-201 (Insertion of Sensitive Information Into Sent Data) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.0.339.0.2211.0.0-rc.3.26522.14810.0.14· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Sockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, reusing a `SocketAsyncEventArgs` instance across IPv4 and IPv6 datagram sockets can retain an undersized cached native address buffer, allowing an unauthenticated out-of-bounds write during `ReceiveFromAsync`. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/466 CVSS Details - Version: 3.1 - Severity: High - Score: 8.1 - Vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows - Architectures: All Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version |…
Recommended action: Upgrade to 11.0.0-rc.3.26522.148 (pre-release), 10.0.14, 9.0.22 or 8.0.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/449 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-407 (Inefficient Algorithmic Complexity) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. DateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/481 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.NETCore.App.Runtime.linux-arm | = 10.0.0, <= 10.0.12 |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/447 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-674 (Uncontrolled Recursion) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.WebSockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/428 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-606: Unchecked Input for Loop Condition Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ |…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/426 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-416: Use After Free Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | -------------------------…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client (System.Net.Http). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 where an attacker can exploit the HTTP/2 protocol to cause an out-of-memory condition. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/422 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name | Affected…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exists in the SMTP client implementation (System.Net.Mail) in .NET 8, .NET 9, and .NET 10, where an attacker can spoof messages during message routing. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: Medium - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness: CWE-116 (Improper Encoding or Escaping of Output) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10.0"</a.NET 10.0 Package name |…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS/SSL connections. An attacker can exploit the SslStream implementation to bypass authorization checks during secure communication. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: High - Score: 8.2 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness: CWE-863 (Incorrect Authorization) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS handshakes. An attacker can send a malformed request and cause application to crash or become unresponsive. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/413 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - Weakness: CWE-1287 (Improper Validation of Specified Type of Input) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/396 CVSS Details - Version: 3.1 - Severity: - Score: 4.3 - Vector:…
Recommended action: Upgrade to 10.0.8, 9.0.16 or 8.0.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/12345 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-138: Improper Neutralization of Special Elements Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 8"</a.NET 8 Package name | Affected version |…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384 CVSS Details - Version: 3.1 - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Severity: High - Weakness: CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read) Affected Platforms - Platforms: All - Architectures: All Affected Products <a name=".NET 9"</a.NET 9 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.4 or 9.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-55248 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A MITM (man in the middle) attacker may prevent use of TLS between client and SMTP server, forcing client to send data over unencrypted connection. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/372 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.20 or earlier. Any .NET 9.0 application running on .NET 9.0.9 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects…
Recommended action: Upgrade to 9.0.10 or 8.0.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by placing files in particular locations, leading to unintended code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/362 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.16 or earlier. Any .NET 9.0 application running on .NET 9.0.5 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.6 or 8.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111425 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111424. <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable web server. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111423 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below <a name=".NET 9"</a.NET 9…
Recommended action: Upgrade to 9.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET runtime TlsStream which may result in Information Disclosure. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/106359 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.7 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below <a name=".NET 8"</a.NET 8 Package name |…
Recommended action: Upgrade to 8.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/312 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.31 or earlier. Any .NET 8.0 application running on .NET 8.0.6 or earlier. <a…
Recommended action: Upgrade to 8.0.7 or 6.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Remote Code Execution vulnerability exists in .NET 7.0 and .NET 8.0 where a stack buffer overrun occurs in .NET Double Parse routine. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/102206 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.18 or earlier. Any .NET 8.0 application running on .NET 8.0.4 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project if it…
Recommended action: Upgrade to 8.0.5 or 7.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. A vulnerability exists in .NET where specially crafted requests may cause a resource leak, leading to a Denial of Service Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/299 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.16 or earlier. Any .NET 8.0 application running on .NET 8.0.2 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project…
Recommended action: Upgrade to 8.0.3 or 7.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to remote code execution. This issue only affects Windows systems. Note: The vulnerabilities CVE-2023-36792, CVE-2023-36793, CVE-2023-36792, CVE-2023-36796 are all resolved by a single patch. Get affected software to resolve all of them. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/91944 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software…
Recommended action: Upgrade to 7.0.11 or 6.0.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.