--- id: "CVE-2026-109475" page: "https://infrastack.ai/live/CVE-2026-109475" kind: "vulnerability" aliases: ["CVE-2026-109475", "GHSA-3g4v-f5gv-c7xf"] title: "Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability" severity: "high" cvss: 7.5 epss: null exploited: false status: "open" category: "runtime" products: [{"name": ".NET", "fixed": [], "affected": "", "ecosystem": "runtime"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-0, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-0, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-0, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.linux-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.NETCore.App.Runtime.osx-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}] ecosystems: ["nuget", "runtime"] tags: ["cwe-121", "dotnet", "httplistener", "linux", "macos", "network-facing", "runtime", "self-hosted"] not_affected_if: ["patched-runtime", "windows-only"] published_at: "2026-11-10T19:18:16+00:00" first_seen_at: "2026-11-10T19:24:24+00:00" updated_at: "2026-11-11T00:43:37+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109475", "first_seen_at": "2026-11-10T19:24:24+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-3g4v-f5gv-c7xf", "first_seen_at": "2026-11-10T23:23:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T00:43:37+00:00"}] exploit_sources: [] --- # Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability Link for people: https://infrastack.ai/live/CVE-2026-109475 (this .md is for agents) Managed HttpListener in .NET recursively processes an unterminated request line, exhausting the process stack. An attacker who sends such a request can crash the process and take the service offline. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - runtime:.NET affected range not listed fixed no fixed version listed - nuget:Microsoft.NETCore.App.Runtime.linux-arm affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-arm64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-x64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-x64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.osx-arm64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.osx-x64 affected >= 8.0.0-0, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.NETCore.App.Runtime.linux-arm affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-arm64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-x64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-x64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.osx-arm64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.osx-x64 affected >= 9.0.0-0, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.NETCore.App.Runtime.linux-arm affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-arm64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-x64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-x64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.osx-arm64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.osx-x64 affected >= 10.0.0-0, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.NETCore.App.Runtime.linux-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.linux-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.linux-musl-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.linux-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.osx-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.NETCore.App.Runtime.osx-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 ## How to check - Check the deployed .NET runtime version against the affected ranges: `8.0.0` to `8.0.33`, `9.0.0` to `9.0.22`, `10.0.0` to `10.0.14`, and `11.0.0-preview.1.26104.118` to `11.0.0-rc.3.26522.148`. - Check application NuGet references for Microsoft.NETCore.App.Runtime.* packages, since self-contained apps carry their own runtime. - Affected platforms are Linux and macOS only. ## Fix - .NET 8: `8.0.34` - .NET 9: `9.0.23` - .NET 10: `10.0.15` - .NET 11: `11.0.0` - Restart applications, and rebuild and redeploy self-contained apps, since updating the machine-wide runtime does not replace their embedded runtime. ## Timeline - 2026-11-10T19:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109475 - 2026-11-10T23:23:58+00:00 ghsa https://github.com/advisories/GHSA-3g4v-f5gv-c7xf - 2026-11-11T00:43:37+00:00 analyst — Read Microsoft/dotnet advisory text (GHSA, linked): managed HttpListener unterminated request line stack exhaustion, Linux/macOS only, fixed 8.0.34/9.0.23/10.0.15/11.0.0; no exploitation or PoC stated; no mitigations listed. ## Documents - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-3g4v-f5gv-c7xf - [advisory] Maintainer's advisory: github.com https://github.com/dotnet/runtime/security/advisories/GHSA-3g4v-f5gv-c7xf - [fix] Release: github.com https://github.com/dotnet/runtime/releases/tag/v10.0.15 - [fix] Release: github.com https://github.com/dotnet/runtime/releases/tag/v11.0.0 - [fix] Release: github.com https://github.com/dotnet/runtime/releases/tag/v8.0.34 - [fix] Release: github.com https://github.com/dotnet/runtime/releases/tag/v9.0.23 ## From the sources ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Managed `HttpListener` can recursively process an unterminated request line and exhaust the process stack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/500 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-121 ## Affected Platforms - **Platforms:** Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately. ### .NET 8.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 [Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34 ### .NET 9.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 [Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23 ### .NET 10.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 [Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15 ### .NET 11.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 ## Advisory FAQ ### How do I know if I am affected? Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it. ### How do I fix the issue? Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references. ## Other Information ### Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue). Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. ### Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion iss --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_