Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

system.formats.cbor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetAmendedPublished

    Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability

    CVE-2026-118747 · GHSA-vmv3-wvjp-wqpj

    Affected
    • NuGet system.formats.cbor >= 8.0.0-0, < 8.0.2; >= 9.0.0-0, < 9.0.24; >= 10.0.0-0, < 10.0.15; >= 11.0.0-0, < 11.0.0
    Fixed in
    8.0.29.0.2410.0.1511.0.0· Vendor fix available
    Issue
    Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/501 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - Weakness: CWE-407 Affected Platforms - Platforms: Any supported OS - Architectures: All Affected Packages The tables list affected package versions and fixed versions. These are independently versioned NuGet packages, not runtime patch versions. 8.0 - standalone packages Package | Affected version | Patched version --- | --- | ---…

    Recommended action: Upgrade to 11.0.0, 10.0.15, 9.0.24 or 8.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →