GHSA-4vgm-c2wm-63mw .NET Denial of Service Vulnerability

• NuGet Microsoft.AspNetCore.App.Runtime.linux-arm: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-arm: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-arm: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.linux-x64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.linux-x64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.linux-x64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.osx-x64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.osx-x64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.osx-x64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.win-arm64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.win-x64: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.win-x64: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.win-x64: >= 10.0.0, < 10.0.4 → fixed in 10.0.4 • NuGet Microsoft.AspNetCore.App.Runtime.win-x86: >= 8.0.0, < 8.0.25 → fixed in 8.0.25 • NuGet Microsoft.AspNetCore.App.Runtime.win-x86: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • NuGet Microsoft.AspNetCore.App.Runtime.win-x86: >= 10.0.0, < 10.0.4 → fixed in 10.0.4

Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/385 CVSS Details • Version: 3.1 • Score: 7.5 • Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` • Severity: High • Weakness: CWE-770 (Uncontrolled Resource Consumption) Affected Platforms • Platforms: All • Architectures: All Affected Products .NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, = 8.0.0, .NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, = 9.0.0, .NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, = 10.0.0, How do I know if I am affected? If using an affected package listed in affected products or affected packages, you're exposed to the vulnerability. How do I fix the issue? 1. To fix the issue please install the latest version of .NET 8.0, NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version. …