{"id":"CVE-2026-109476","kind":"vulnerability","aliases":["CVE-2026-109476"],"related":[],"title":"ASP.NET Core: improper output encoding lets an attacker read information over network","description":"Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.","summary":"ASP.NET Core does not properly encode or escape some output, so an unauthenticated attacker on the network can disclose information. The sources give no further detail on which data or which component is exposed.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ASP.NET Core","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":[".net","aspnet-core","runtime","web-apps"],"not_affected_if":[],"how_to_check":"- Check the ASP.NET Core runtime version with `dotnet --list-runtimes`","fix":null,"status":"open","published_at":"2026-11-10T19:18:16+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","triaged_at":"2026-11-10T19:58:33+00:00","updated_at":"2026-11-10T19:58:33+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T19:58:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core: improper output encoding lets an attacker read information over network","impact":"low","summary":"ASP.NET Core does not properly encode or escape some output, so an unauthenticated attacker on the network can disclose information. The sources give no further detail on which data or which component is exposed.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core",".net","web-apps"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads information disclosed by the application","analyst_note":"Find the affected versions, fixed versions and triggering feature from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-109476) or the Microsoft advisory.","how_to_check":"- Check the ASP.NET Core runtime version with `dotnet --list-runtimes`\n- unknown: the sources do not say which versions are affected or which feature triggers the flaw","plain_action":"","product_name":"ASP.NET Core","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources describe only a network-reachable information disclosure in ASP.NET Core with no authentication needed, and do not name the affected versions or the triggering feature.","user_interaction":"unknown","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4496,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109476':15A,18A '-2026':14A,17A 'allow':72C 'app':28B 'asp.net':1A,19A,29B,70C 'aspnet':23B 'aspnet-cor':22B 'attack':8A,42B,75C 'compon':60B 'core':2A,20A,24B,30B,71C 'cve':13A,16A 'data':57B 'detail':54B 'disclos':47B,77C 'encod':5A,34B,64C 'escap':36B,66C 'expos':62B 'give':51B 'improp':3A,63C 'inform':10A,48B,78C 'let':6A 'net':21B 'network':12A,45B,81C 'output':4A,38B,68C 'proper':33B 'read':9A 'runtim':25B 'sourc':50B 'unauthent':41B 'unauthor':74C 'web':27B 'web-app':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aspnetcore","core"],"ptokens":["asp","core","net"],"labels":["aspnetcore","medium","net","runtime","webapps"],"campaign_type":null,"search_a":"'-109476':15A,18A '-2026':14A,17A 'asp.net':1A,19A 'attack':8A 'core':2A,20A 'cve':13A,16A 'encod':5A 'improp':3A 'inform':10A 'let':6A 'network':12A 'output':4A 'read':9A","search_b":"'app':28B 'asp.net':29B 'aspnet':23B 'aspnet-cor':22B 'attack':42B 'compon':60B 'core':24B,30B 'data':57B 'detail':54B 'disclos':47B 'encod':34B 'escap':36B 'expos':62B 'give':51B 'inform':48B 'net':21B 'network':45B 'output':38B 'proper':33B 'runtim':25B 'sourc':50B 'unauthent':41B 'web':27B 'web-app':26B","search_c":"'allow':72C 'asp.net':70C 'attack':75C 'core':71C 'disclos':77C 'encod':64C 'escap':66C 'improp':63C 'inform':78C 'network':81C 'output':68C 'unauthor':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109476","severity":null,"published_at":"2026-11-10T19:18:16+00:00","modified_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","fetched_at":"2026-11-10T19:24:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}