--- id: "CVE-2026-109476" page: "https://infrastack.ai/live/CVE-2026-109476" kind: "vulnerability" aliases: ["CVE-2026-109476", "GHSA-xhj5-c3g8-pfj8"] title: "Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability" severity: "medium" cvss: 6.1 epss: null exploited: false status: "open" category: "runtime" products: [{"name": "ASP.NET Core", "fixed": [], "affected": "", "ecosystem": "runtime"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["8.0.34"], "affected": ">= 8.0.0-rc.1.23421.29, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}] ecosystems: ["nuget", "runtime"] tags: [".net", "aspnet-core", "cwe-116", "linux", "macos", "runtime", "web-apps", "windows"] not_affected_if: ["no-forwarded-prefix-header", "no-pathbase", "unaffected-version"] published_at: "2026-11-10T19:18:16+00:00" first_seen_at: "2026-11-10T19:24:24+00:00" updated_at: "2026-11-10T23:03:56+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109476", "first_seen_at": "2026-11-10T19:24:24+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-xhj5-c3g8-pfj8", "first_seen_at": "2026-11-10T23:03:25+00:00"}] exploit_sources: [] --- # Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability Link for people: https://infrastack.ai/live/CVE-2026-109476 (this .md is for agents) A crafted X-Forwarded-Prefix header can inject cookie path delimiters into cookies built from PathBase when semicolons are not percent-encoded. The advisory describes this as an information disclosure flaw that an attacker can trigger against a user, with high confidentiality impact in the CVSS vector. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - runtime:ASP.NET Core affected range not listed fixed no fixed version listed - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 8.0.0-rc.1.23421.29, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 ## How to check - Check the ASP.NET Core runtime version in use with `dotnet --list-runtimes` and compare it to the affected ranges. - Check the `Microsoft.AspNetCore.App.Runtime` and related package versions referenced by each application project file. - Look for applications that set PathBase or sit behind a proxy that forwards X-Forwarded-Prefix. ## Fix - .NET 8.0: `8.0.34` - .NET 9.0: `9.0.23` - .NET 10.0: `10.0.15` - .NET 11.0: `11.0.0` ## Timeline - 2026-11-10T19:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109476 - 2026-11-10T23:03:25+00:00 ghsa https://github.com/advisories/GHSA-xhj5-c3g8-pfj8 ## Documents - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-xhj5-c3g8-pfj8 - [advisory] Maintainer's advisory: github.com https://github.com/dotnet/aspnetcore/security/advisories/GHSA-xhj5-c3g8-pfj8 - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/1fa5639647ddd2061bafe2ccf60bdc1c345b0b34 - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/7ce5a6b05d4d6694bb688bf7053ebb594c00a8e5 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23 ## From the sources ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A crafted `X-Forwarded-Prefix` can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.1 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C` - **Weakness:** CWE-116 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately. ### .NET 8.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34 ### .NET 9.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 ### .NET 10.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 ### .NET 11.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-x64](https:// --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_