--- id: "CVE-2026-114149" page: "https://infrastack.ai/live/CVE-2026-114149" kind: "vulnerability" aliases: ["CVE-2026-114149", "GHSA-x33c-w48q-qrgc"] title: "Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability" severity: "high" cvss: 7.5 epss: null exploited: false status: "open" category: "runtime" products: [{"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.WebUtilities", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.5.23302.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.WebUtilities", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}] ecosystems: ["nuget"] tags: ["aspnet-core", "cwe-770", "dotnet", "multipart", "runtime", "self-hosted", "web-api"] not_affected_if: ["no-multipart-endpoints", "no-multipart-forms", "patched-runtime"] published_at: "2026-11-10T19:19:08+00:00" first_seen_at: "2026-11-10T19:24:43+00:00" updated_at: "2026-11-10T23:44:35+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114149", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-x33c-w48q-qrgc", "first_seen_at": "2026-11-10T23:08:37+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T23:44:35+00:00"}] exploit_sources: [] --- # Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability Link for people: https://infrastack.ai/live/CVE-2026-114149 (this .md is for agents) ASP.NET Core multipart form processing can bypass the configured header-count limit, so a remote unauthenticated request can consume excessive server resources and cause denial of service (CVSS 7.5 High). Microsoft lists no exploitation; exploit-maturity is 'unproven' in the vector (E:U). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.WebUtilities affected >= 8.0.0-preview.5.23302.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.WebUtilities affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 ## How to check 1. Run 'dotnet --list-runtimes' and look at Microsoft.AspNetCore.App: affected if <= 8.0.33, <= 9.0.22, <= 10.0.14, or 11.0.0 preview/RC (<= 11.0.0-rc.3.26522.148). 2. Self-contained apps: check the Microsoft.AspNetCore.App.Runtime. versions in the project and publish output; updating the machine runtime does not replace the embedded one. 3. Check project/lock files for Microsoft.AspNetCore.WebUtilities at the same affected versions; an SDK update does not change standalone package references. ## Fix Install .NET runtime 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (or update Microsoft.AspNetCore.WebUtilities / App.Runtime packages to those versions). Rebuild and redeploy self-contained and package-referencing apps (a restart alone does not replace app-local packages), then restart. ## Timeline - 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114149 - 2026-11-10T23:08:37+00:00 ghsa https://github.com/advisories/GHSA-x33c-w48q-qrgc - 2026-11-10T23:44:35+00:00 analyst — Read the dotnet/aspnetcore GHSA (vendor advisory): fix versions, check and affected packages confirmed. Gaps: win-x86 and WebUtilities added; 9/10/11 ranges per advisory (9.0.0-preview.1.24081.5..9.0.22, 10.0.0-preview.1.25120.3..10.0.14, 11.0.0-preview.1.26104.118..11.0.0-rc.3.26522.148) not fully restated as products because the row replaces by name. MSRC/NVD not read; X/search not used; exact trigger endpoint and header limit not specified by advisory. ## Documents - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-x33c-w48q-qrgc - [advisory] Maintainer's advisory: github.com https://github.com/dotnet/aspnetcore/security/advisories/GHSA-x33c-w48q-qrgc - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/e2fdf87f23ce5747bce1ac9a8c34905b17799a68 - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/eea3265c048c88f9c064fc1ff2b3be9570b6f8cc - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23 ## From the sources ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately. ### .NET 8.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 ### .NET 9.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 ### .NET 10.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 ### .NET 11.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 [Microsoft.AspNetCore.App.Runtime.li --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_