Live › vulnerability › CVE-2026-96236
Go to dashboardASP.NET Core request-localization fallback can add attacker-supplied synthetic culture names to the runtime's global cache. An unauthenticated attacker can send crafted requests to grow memory without bound and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 |
| nuget |
| >= 8.0.0, <= 8.0.31 |
| 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
dotnet --info and check whether the installed Microsoft.AspNetCore.App runtime is in an affected range (8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, or 11.0.0-preview.1 to 11.0.0-rc.1)8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 or later, per the patched version for your major line, then restart appsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Localization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
ASP.NET Core request-localization fallback can add attacker-supplied synthetic culture names to the runtime's global cache, allowing unauthenticated requests to cause unbounded memory growth and denial of service.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/484
Version: 3.1
Severity: High
Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling)
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
This page as .md · .json · in your agent: get_signal("CVE-2026-96236")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| >= 8.0.0, <= 8.0.31 |
| 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runt |