{"id":"GHSA-p3jp-9v83-76w9","kind":"vulnerability","aliases":["GHSA-p3jp-9v83-76w9"],"related":[],"title":"Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability","description":"## Executive summary\n\nA buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.\n\nASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/494\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.1\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Mitigations\n\nASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:\n\n- Enable ASP.NET Core [automatic request decompression](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression) with Brotli (`br`) support.\n- Enable HttpClient automatic response decompression by configuring [HttpClientHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression) or [SocketsHttpHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression) to include [DecompressionMethods.Brotli](https://learn.microsoft.com/dotnet/api/system.net.decompressionmethods) or `DecompressionMethods.All`.\n- Explicitly use Brotli decompression APIs in `System.IO.Compression`, such as `BrotliStream` or `BrotliDecoder`.\n\nUntil the update can be deployed, avoid decompressing attacker-controlled Brotli data.\n\nThe following examples show how to disable Brotli decompression if you are already using it.\n\n> **Warning: Do not use these code snippets if you are not already using decompression.** Do not introduce a call to `AddRequestDecompression` if your application does not already call it. Similarly, do not introduce an `AutomaticDecompression` property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.\n\nIf you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the `br` entry from your existing decompression configuration. This retains the default gzip and deflate providers:\n\n```csharp\nbuilder.Services.AddRequestDecompression(options =>\n{\n    options.DecompressionProviders.Remove(\"br\");\n});\n```\n\nIf your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include `DecompressionMethods.Brotli`:\n\n```csharp\nvar handler = new HttpClientHandler\n{\n    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate\n};\n\nvar httpClient = new HttpClient(handler);\n```\n\nApplications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.\n\n### .NET 8\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x86) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.33 | 8.0.33\n\n### .NET 9\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.22 | 9.0.22\n\n### .NET 10\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.14 | 10.0.14\n\n### .NET 11 previews\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.browser-wasm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.ios-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvos-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nYou are affected if your application uses an affected Brotli decoder included in a package listed in [affected packages](#affected-packages), including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See [mitigations](#mitigations) for the affected usage paths and default settings.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.\n\n.NET release | Runtime | SDK versions\n------------ | ------- | ------------\n.NET 8 | 8.0.33 | 8.0.133, 8.0.427\n.NET 9 | 9.0.22 | 9.0.123, 9.0.320\n.NET 10 | 10.0.14 | 10.0.114, 10.0.403\n.NET 11 previews | 11.0.0-rc.3.26522.148 | 11.0.100-rc.3.26522.148\n\nDownload .NET from https://dotnet.microsoft.com/download/dotnet.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nIf you have deployed [self-contained applications](https://learn.microsoft.com/dotnet/core/deploying/#self-contained-deployments), rebuild and redeploy those applications with the updated runtime.\n\nFor NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine's shared runtime alone does not replace a decoder already linked into a NativeAOT executable.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497)\n\n### Revisions\n\nV1.0 (10/25/2026): Initial advisory.","summary":"A buffer overflow in the Brotli decompression library used by .NET lets an unauthenticated attacker read or corrupt process memory. The sources say this can lead to information disclosure, denial of service, or privilege elevation.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.DotNet.ILCompiler","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x86","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.linux-arm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.linux-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.linux-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.osx-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.osx-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.win-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.win-x86","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-arm64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x64","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x86","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"nuget"},{"name":"Microsoft.DotNet.ILCompiler","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x86","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x86","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-arm64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x64","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x86","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"nuget"},{"name":"Microsoft.DotNet.ILCompiler","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x86","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x86","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.android-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.android-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-arm64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x64","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x86","fixed":["10.0.14"],"affected":">= 10.0.0, < 10.0.14","ecosystem":"nuget"},{"name":"Microsoft.DotNet.ILCompiler","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.android-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.NativeAOT.win-x86","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.android-x86","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.android-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.android-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.android-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.browser-wasm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.ios-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.iossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.iossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-bionic-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.linux-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.maccatalyst-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.maccatalyst-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.osx-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.tvos-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.tvossimulator-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.tvossimulator-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-arm64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x64","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"},{"name":"Microsoft.NETCore.App.Runtime.win-x86","fixed":["11.0.0-rc.3.26522.148"],"affected":">= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["asp.net-core","cwe-787","dotnet","httpclient","nativeaot","runtime"],"not_affected_if":["default-config","dotnet-framework","no-brotli-decompression"],"how_to_check":"- Run `dotnet --list-runtimes` and check whether any runtime is below `8.0.33` for .NET 8.\n- Search project files and lockfiles for `Microsoft.NETCore.App.Runtime` and `Microsoft.DotNet.ILCompiler` package references below `8.0.33`.\n- Check whether ASP.NET Core request decompression (`AddRequestDecompression`) or HttpClient `AutomaticDecompression` includes Brotli, or whether code calls `BrotliStream` or `BrotliDecoder` on untrusted input.","fix":"- .NET 8: move to `8.0.33` or later for the affected runtime and NativeAOT packages.","status":"open","published_at":"2026-11-03T17:33:48+00:00","first_seen_at":"2026-11-03T17:36:46+00:00","triaged_at":"2026-11-03T17:38:32+00:00","updated_at":"2026-11-03T17:38:32+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-03T17:38:32Z","model":"claude-haiku-5-5","output":{"fix":"- .NET 8: move to `8.0.33` or later for the affected runtime and NativeAOT packages.","reach":"internet","title":".NET: Brotli decoder out-of-bounds write lets unauthenticated attackers corrupt memory","impact":"high","summary":"A buffer overflow in the Brotli decompression library used by .NET lets an unauthenticated attacker read or corrupt process memory. The sources say this can lead to information disclosure, denial of service, or privilege elevation.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["dotnet","asp.net-core","nativeaot","httpclient"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts process memory, reads data, or crashes the service.","analyst_note":"Confirm whether the NuGet runtime and ILCompiler packages in the affected list apply to ordinary server deployments, and check the linked maintainer advisory for exploitation details.","how_to_check":"- Run `dotnet --list-runtimes` and check whether any runtime is below `8.0.33` for .NET 8.\n- Search project files and lockfiles for `Microsoft.NETCore.App.Runtime` and `Microsoft.DotNet.ILCompiler` package references below `8.0.33`.\n- Check whether ASP.NET Core request decompression (`AddRequestDecompression`) or HttpClient `AutomaticDecompression` includes Brotli, or whether code calls `BrotliStream` or `BrotliDecoder` on untrusted input.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-brotli-decompression","dotnet-framework"],"who_is_affected":"Exposure requires an application that decompresses attacker-controlled Brotli data, through ASP.NET Core request decompression, HttpClient automatic decompression with Brotli enabled, or direct use of BrotliStream or BrotliDecoder. The sources state that an application is not exposed merely because an affected package is installed, and that .NET Framework is not affected. Teams that do not enable Brotli decompression on untrusted input can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001515,"input_tokens":11233,"output_tokens":784,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111497':6A '-2026':5A '-787':557B,717C '/aspnet/core/fundamentals/middleware/request-decompression)':781C '/av':703C '/dotnet/announcements/issues/494':691C '/dotnet/api/system.net.decompressionmethods)':807C '/dotnet/api/system.net.http.httpclienthandler.automaticdecompression)':796C '/dotnet/api/system.net.http.socketshttphandler.automaticdecompression)':801C '3.1':695C,702C '76w9':20A,25A '8.1':699C '9v83':19A,24A 'addrequestdecompress':870C 'advisori':3A 'affect':679C,723C,752C,1027C,1047C,1051C,1056C 'allow':615C 'alreadi':847C,861C,876C,892C,920C,956C 'announc':680C,681C 'api':665C,814C,997C,1006C 'applic':652C,745C,760C,873C,889C,955C,991C,1012C,1053C 'architectur':727C 'arm':62A,78A,110A,124A,153A,159A,171A,203A,233A,247A,270A,282A,288A,300A,332A,366A,380A,403A,415A,421A,433A,465A,495A,509A,523A 'arm64':28A,30A,36A,42A,46A,50A,52A,56A,64A,72A,74A,80A,88A,94A,98A,100A,112A,116A,128A,136A,140A,147A,149A,155A,163A,175A,183A,187A,191A,193A,197A,205A,213A,215A,219A,225A,227A,235A,239A,251A,259A,263A,272A,276A,278A,284A,292A,304A,312A,316A,320A,322A,326A,334A,342A,344A,348A,354A,356A,362A,368A,372A,384A,392A,396A,405A,409A,411A,417A,425A,437A,445A,449A,453A,455A,459A,467A,475A,477A,481A,487A,489A,497A,503A,505A,511A,515A,527A,535A,539A,543A,545A,549A 'asp.net':554B,638C,730C,774C,926C 'assign':886C 'attack':576B,618C,669C,764C,831C 'attacker-control':668C,763C,830C 'automat':644C,736C,776C,788C,903C,959C 'automaticdecompress':884C,983C 'avoid':828C 'bionic':35A,39A,115A,119A,158A,162A,166A,238A,242A,287A,291A,295A,371A,375A,420A,424A,428A,514A,518A 'bionic-arm':157A,286A,419A 'bionic-arm64':34A,114A,161A,237A,290A,370A,423A,513A 'bionic-x64':38A,118A,165A,241A,294A,374A,427A,517A 'bound':13A,721C 'br':784C,933C,952C 'brot':8A,567B,606C,646C,658C,663C,766C,783C,812C,833C,842C,914C,922C,963C,995C,1002C,1022C,1057C 'brotlidecod':821C 'brotlistream':819C 'buffer':563B,600C 'builder.services.addrequestdecompression':949C 'c':714C 'call':868C,877C 'chang':1025C 'code':855C,1013C 'configur':651C,792C,901C,939C 'continu':1016C 'control':670C,765C,832C 'core':555B,639C,731C,775C,927C 'corrupt':579B,622C 'could':626C 'csharp':948C,978C 'cve':4A 'cvss':692C,701C 'cwe':556B,716C 'data':647C,671C,767C,834C,1003C,1023C 'decod':9A,1058C 'decompress':568B,607C,645C,659C,664C,733C,738C,762C,778C,790C,813C,829C,843C,863C,900C,904C,924C,938C,961C,996C,1018C 'decompressionmethods.all':809C 'decompressionmethods.brotli':804C,977C 'decompressionmethods.deflate':985C 'decompressionmethods.gzip':984C 'default':650C,743C,943C 'deflat':946C 'denial':591B,631C,908C 'denial-of-servic':907C 'deploy':827C,1038C 'describ':673C 'detail':693C 'direct':993C 'disabl':841C,962C 'disclosur':590B,630C 'dotnet':558B 'elev':596B,635C 'enabl':657C,741C,773C,786C,902C,957C 'ensur':1009C 'entri':934C 'even':912C 'exampl':837C 'exclud':916C,928C 'execut':597C 'exist':603C,899C,937C,970C 'explicit':661C,810C 'expos':654C,748C 'exposur':757C 'fix':1046C 'flag':967C 'follow':836C 'found':687C 'framework':676C 'ghsa':17A,22A 'ghsa-p3jp-9v83-76w9':16A,21A 'github.com':690C 'github.com/dotnet/announcements/issues/494':689C 'gzip':944C 'h/a':710C 'h/e':711C 'h/i':709C 'h/pr':705C 'handl':1032C 'handler':971C,980C,990C 'high':697C 'httpclient':559B,641C,735C,787C,958C,987C,989C 'httpclienthandl':982C 'httpclienthandler.automaticdecompression':793C 'includ':803C,976C 'inform':589B,629C 'instal':756C,1039C 'introduc':866C,882C,906C 'issu':684C 'lead':587B,627C 'learn.microsoft.com':780C,795C,800C,806C 'learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression)':779C 'learn.microsoft.com/dotnet/api/system.net.decompressionmethods)':805C 'learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression)':794C 'learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression)':799C 'let':573B 'librari':569B,608C 'may':614C 'memori':581B,624C 'mere':749C 'microsoft':1A 'microsoft.dotnet.ilcompiler':26A,145A,268A,401A 'microsoft.netcore.app.runtime.android':361A,363A,494A,496A,498A 'microsoft.netcore.app.runtime.browser':500A 'microsoft.netcore.app.runtime.ios':502A 'microsoft.netcore.app.runtime.iossimulator':504A,506A 'microsoft.netcore.app.runtime.linux':109A,111A,113A,117A,121A,125A,129A,133A,232A,234A,236A,240A,244A,248A,252A,256A,365A,367A,369A,373A,377A,381A,385A,389A,508A,510A,512A,516A,520A,524A,528A,532A 'microsoft.netcore.app.runtime.maccatalyst':534A,536A 'microsoft.netcore.app.runtime.mono.android':61A,63A,65A,67A,202A,204A,206A,208A,331A,333A,335A,337A,464A,466A,468A,470A 'microsoft.netcore.app.runtime.mono.browser':69A,210A,339A,472A 'microsoft.netcore.app.runtime.mono.ios':71A,212A,341A,474A 'microsoft.netcore.app.runtime.mono.iossimulator':73A,75A,214A,216A,343A,345A,476A,478A 'microsoft.netcore.app.runtime.mono.linux':77A,79A,81A,85A 'microsoft.netcore.app.runtime.mono.llvm.linux':55A,57A 'microsoft.netcore.app.runtime.mono.llvm.osx':59A 'microsoft.netcore.app.runtime.mono.maccatalyst':87A,89A,218A,220A,347A,349A,480A,482A 'microsoft.netcore.app.runtime.mono.multithread.browser':91A,222A,351A,484A 'microsoft.netcore.app.runtime.mono.osx':93A,95A 'microsoft.netcore.app.runtime.mono.tvos':97A,224A,353A,486A 'microsoft.netcore.app.runtime.mono.tvossimulator':99A,101A,226A,228A,355A,357A,488A,490A 'microsoft.netcore.app.runtime.mono.wasi':103A,230A,359A,492A 'microsoft.netcore.app.runtime.mono.win':105A,107A 'microsoft.netcore.app.runtime.nativeaot.android':269A,271A,273A,402A,404A,406A 'microsoft.netcore.app.runtime.nativeaot.ios':27A,146A,275A,408A 'microsoft.netcore.app.runtime.nativeaot.iossimulator':29A,31A,148A,150A,277A,279A,410A,412A 'microsoft.netcore.app.runtime.nativeaot.linux':33A,37A,152A,154A,156A,160A,164A,168A,172A,176A,180A,281A,283A,285A,289A,293A,297A,301A,305A,309A,414A,416A,418A,422A,426A,430A,434A,438A,442A 'microsoft.netcore.app.runtime.nativeaot.maccatalyst':41A,43A,182A,184A,311A,313A,444A,446A 'microsoft.netcore.app.runtime.nativeaot.osx':45A,47A,186A,188A,315A,317A,448A,450A 'microsoft.netcore.app.runtime.nativeaot.tvos':49A,190A,319A,452A 'microsoft.netcore.app.runtime.nativeaot.tvossimulator':51A,53A,192A,194A,321A,323A,454A,456A 'microsoft.netcore.app.runtime.nativeaot.win':196A,198A,200A,325A,327A,329A,458A,460A,462A 'microsoft.netcore.app.runtime.osx':135A,137A,258A,260A,391A,393A,538A,540A 'microsoft.netcore.app.runtime.tvos':542A 'microsoft.netcore.app.runtime.tvossimulator':544A,546A 'microsoft.netcore.app.runtime.win':139A,141A,143A,262A,264A,266A,395A,397A,399A,548A,550A,552A 'mitig':729C 'modifi':896C 'musl':83A,123A,127A,131A,170A,174A,178A,246A,250A,254A,299A,303A,307A,379A,383A,387A,432A,436A,440A,522A,526A,530A 'musl-arm':122A,169A,245A,298A,378A,431A,521A 'musl-arm64':126A,173A,249A,302A,382A,435A,525A 'musl-x64':82A,130A,177A,253A,306A,386A,439A,529A 'must':998C 'n/ac':704C 'n/s':707C 'n/ui':706C 'nativeaot':560B,1063C 'net':7A,572B,611C,675C,753C,1052C 'new':981C,988C 'normal':1028C 'o/rc':713C 'one':769C 'option':950C 'options.decompressionproviders.remove':951C 'out-of-bound':10A,718C 'overflow':564B,601C 'p3jp':18A,23A 'packag':754C,1048C 'pass':1000C 'path':772C 'platform':724C,725C 'privileg':595B,637C 'process':580B,623C,667C 'properti':885C,895C 'provid':947C 'read':577B,620C 'recommend':1045C 'remain':1043C 'remov':931C 'request':732C,777C,923C,1029C 'requir':758C 'respons':737C,789C,960C,1031C 'retain':941C 'risk':911C 'runtim':561B,1061C 'say':584B 'score':698C 'secur':2A,1041C 'servic':593B,633C,910C 'set':893C 'sever':696C 'show':838C 'similar':879C 'snippet':856C 'socketshttphandler.automaticdecompression':798C 'sourc':583B 'stop':999C 'summari':598C 'support':785C 'system.io.compression':816C 'test':1036C 'u/c':708C 'u/rl':712C 'unauthent':575B,617C 'untrust':1001C,1021C 'updat':824C,965C,1008C,1042C 'use':570B,609C,662C,811C,848C,853C,862C,921C,994C,1054C 'var':979C,986C 'vector':700C 'version':694C 'vulner':15A,602C,613C,1050C 'warn':850C 'wasm':70A,92A,104A,211A,223A,231A,340A,352A,360A,473A,485A,493A,501A 'weak':715C 'write':14A,722C 'x64':32A,40A,44A,48A,54A,58A,60A,66A,76A,84A,86A,90A,96A,102A,106A,120A,132A,134A,138A,142A,151A,167A,179A,181A,185A,189A,195A,199A,207A,217A,221A,229A,243A,255A,257A,261A,265A,274A,280A,296A,308A,310A,314A,318A,324A,328A,336A,346A,350A,358A,364A,376A,388A,390A,394A,398A,407A,413A,429A,441A,443A,447A,451A,457A,461A,469A,479A,483A,491A,499A,507A,519A,531A,533A,537A,541A,547A,551A 'x86':68A,108A,144A,201A,209A,267A,330A,338A,400A,463A,471A,553A","nicknames":[],"mitigations":[],"who_affected":"Exposure requires an application that decompresses attacker-controlled Brotli data, through ASP.NET Core request decompression, HttpClient automatic decompression with Brotli enabled, or direct use of BrotliStream or BrotliDecoder. The sources state that an application is not exposed merely because an affected package is installed, and that .NET Framework is not affected. Teams that do not enable Brotli decompression on untrusted input can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["microsoftdotnetilcompiler","microsoftnetcoreappruntimeandroidarm","microsoftnetcoreappruntimeandroidarm64","microsoftnetcoreappruntimeandroidx64","microsoftnetcoreappruntimebrowserwasm","microsoftnetcoreappruntimeiosarm64","microsoftnetcoreappruntimeiossimulatorarm64","microsoftnetcoreappruntimeiossimulatorx64","microsoftnetcoreappruntimelinuxarm","microsoftnetcoreappruntimelinuxarm64","microsoftnetcoreappruntimelinuxbionicarm64","microsoftnetcoreappruntimelinuxbionicx64","microsoftnetcoreappruntimelinuxmuslarm","microsoftnetcoreappruntimelinuxmuslarm64","microsoftnetcoreappruntimelinuxmuslx64","microsoftnetcoreappruntimelinuxx64","microsoftnetcoreappruntimemaccatalystarm64","microsoftnetcoreappruntimemaccatalystx64","microsoftnetcoreappruntimemonoandroidarm","microsoftnetcoreappruntimemonoandroidarm64","microsoftnetcoreappruntimemonoandroidx64","microsoftnetcoreappruntimemonoandroidx86","microsoftnetcoreappruntimemonobrowserwasm","microsoftnetcoreappruntimemonoiosarm64","microsoftnetcoreappruntimemonoiossimulatorarm64","microsoftnetcoreappruntimemonoiossimulatorx64","microsoftnetcoreappruntimemonolinuxarm","microsoftnetcoreappruntimemonolinuxarm64","microsoftnetcoreappruntimemonolinuxmuslx64","microsoftnetcoreappruntimemonolinuxx64","microsoftnetcoreappruntimemonollvmlinuxarm64","microsoftnetcoreappruntimemonollvmlinuxx64","microsoftnetcoreappruntimemonollvmosxx64","microsoftnetcoreappruntimemonomaccatalystarm64","microsoftnetcoreappruntimemonomaccatalystx64","microsoftnetcoreappruntimemonomultithreadbrowserwasm","microsoftnetcoreappruntimemonoosxarm64","microsoftnetcoreappruntimemonoosxx64","microsoftnetcoreappruntimemonotvosarm64","microsoftnetcoreappruntimemonotvossimulatorarm64","microsoftnetcoreappruntimemonotvossimulatorx64","microsoftnetcoreappruntimemonowasiwasm","microsoftnetcoreappruntimemonowinx64","microsoftnetcoreappruntimemonowinx86","microsoftnetcoreappruntimenativeaotandroidarm","microsoftnetcoreappruntimenativeaotandroidarm64","microsoftnetcoreappruntimenativeaotandroidx64","microsoftnetcoreappruntimenativeaotiosarm64","microsoftnetcoreappruntimenativeaotiossimulatorarm64","microsoftnetcoreappruntimenativeaotiossimulatorx64","microsoftnetcoreappruntimenativeaotlinuxarm","microsoftnetcoreappruntimenativeaotlinuxarm64","microsoftnetcoreappruntimenativeaotlinuxbionicarm","microsoftnetcoreappruntimenativeaotlinuxbionicarm64","microsoftnetcoreappruntimenativeaotlinuxbionicx64","microsoftnetcoreappruntimenativeaotlinuxmuslarm","microsoftnetcoreappruntimenativeaotlinuxmuslarm64","microsoftnetcoreappruntimenativeaotlinuxmuslx64","microsoftnetcoreappruntimenativeaotlinuxx64","microsoftnetcoreappruntimenativeaotmaccatalystarm64","microsoftnetcoreappruntimenativeaotmaccatalystx64","microsoftnetcoreappruntimenativeaotosxarm64","microsoftnetcoreappruntimenativeaotosxx64","microsoftnetcoreappruntimenativeaottvosarm64","microsoftnetcoreappruntimenativeaottvossimulatorarm64","microsoftnetcoreappruntimenativeaottvossimulatorx64","microsoftnetcoreappruntimenativeaotwinarm64","microsoftnetcoreappruntimenativeaotwinx64","microsoftnetcoreappruntimenativeaotwinx86","microsoftnetcoreappruntimeosxarm64","microsoftnetcoreappruntimeosxx64","microsoftnetcoreappruntimetvosarm64","microsoftnetcoreappruntimetvossimulatorarm64","microsoftnetcoreappruntimetvossimulatorx64","microsoftnetcoreappruntimewinarm64","microsoftnetcoreappruntimewinx64","microsoftnetcoreappruntimewinx86"],"ptokens":["android","app","arm","arm64","bionic","browser","dotnet","ilcompiler","ios","iossimulator","linux","llvm","maccatalyst","microsoft","mono","multithread","musl","nativeaot","netcore","osx","runtime","tvos","tvossimulator","wasi","wasm","win","x64","x86"],"labels":["aspnetcore","cwe787","dotnet","high","httpclient","nativeaot","nuget","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T17:33:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p3jp-9v83-76w9","url":"https://github.com/advisories/GHSA-p3jp-9v83-76w9","severity":"high","published_at":"2026-11-03T17:33:48+00:00","modified_at":"2026-11-03T17:33:55+00:00","first_seen_at":"2026-11-03T17:36:46+00:00","fetched_at":"2026-11-03T17:36:46+00:00","note":null}],"documents":[{"id":59317,"url":"https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-p3jp-9v83-76w9","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59318,"url":"https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59319,"url":"https://github.com/dotnet/runtime/pull/136471","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59320,"url":"https://github.com/dotnet/runtime/commit/f3d8b2f230bc7c9899df6eef2d41e2748107cffa","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}