{"url":"http://public2.vulnerablecode.io/api/packages/62375?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.0","type":"nuget","namespace":"","name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","version":"6.0.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"7.0.19","latest_non_vulnerable_version":"10.0.4","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12730?format=json","vulnerability_id":"VCID-5n75-cxug-2uaj","summary":"Denial Of Service\nThis advisory has been marked as a false positive.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21986.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21986.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21986","reference_id":"","reference_type":"","scores":[{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82452","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82433","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82429","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82418","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82304","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82351","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82344","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82317","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82322","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82396","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82393","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82392","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82358","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82364","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01714","scoring_system":"epss","scoring_elements":"0.82371","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21986"},{"reference_url":"https://github.com/dotnet/announcements/issues/207","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/announcements/issues/207"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-x459-p2rx-f8ff","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-x459-p2rx-f8ff"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT/"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21986","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21986"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051490","reference_id":"2051490","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051490"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21986","reference_id":"CVE-2022-21986","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21986"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21986","reference_id":"CVE-2022-21986","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21986"},{"reference_url":"https://github.com/advisories/GHSA-x459-p2rx-f8ff","reference_id":"GHSA-x459-p2rx-f8ff","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x459-p2rx-f8ff"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0495","reference_id":"RHSA-2022:0495","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0495"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0496","reference_id":"RHSA-2022:0496","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0496"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0499","reference_id":"RHSA-2022:0499","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0499"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0500","reference_id":"RHSA-2022:0500","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0500"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79401?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-ew2m-qrrh-dkbf"},{"vulnerability":"VCID-m6bh-57h2-73a3"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-r5g1-zwbg-xubc"},{"vulnerability":"VCID-rz8f-jn6b-a7fw"},{"vulnerability":"VCID-ujyg-uwtg-vqbt"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.2"}],"aliases":["CVE-2022-21986","GHSA-x459-p2rx-f8ff"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5n75-cxug-2uaj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/18286?format=json","vulnerability_id":"VCID-dp82-cuxf-9yhq","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\nASP.NET and Visual Studio Security Feature Bypass Vulnerability","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-33170.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-33170.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33170","reference_id":"","reference_type":"","scores":[{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43721","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44011","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44033","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43964","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44015","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44017","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44032","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43984","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44046","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44037","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43971","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43923","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43927","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43842","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33170"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/issues/49334","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/issues/49334"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221854","reference_id":"2221854","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221854"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170","reference_id":"CVE-2023-33170","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33170","reference_id":"CVE-2023-33170","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33170"},{"reference_url":"https://github.com/advisories/GHSA-25c8-p796-jg6r","reference_id":"GHSA-25c8-p796-jg6r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-25c8-p796-jg6r"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r","reference_id":"GHSA-25c8-p796-jg6r","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4057","reference_id":"RHSA-2023:4057","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4057"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4058","reference_id":"RHSA-2023:4058","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4058"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4059","reference_id":"RHSA-2023:4059","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4059"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4060","reference_id":"RHSA-2023:4060","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4060"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4061","reference_id":"RHSA-2023:4061","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4061"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4448","reference_id":"RHSA-2023:4448","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4448"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:4449","reference_id":"RHSA-2023:4449","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:4449"},{"reference_url":"https://usn.ubuntu.com/6217-1/","reference_id":"USN-6217-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6217-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/58808?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.20","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.20"},{"url":"http://public2.vulnerablecode.io/api/packages/58809?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.9"}],"aliases":["CVE-2023-33170","GHSA-25c8-p796-jg6r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dp82-cuxf-9yhq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13213?format=json","vulnerability_id":"VCID-ew2m-qrrh-dkbf","summary":"This advisory has been marked as False-Positive and removed.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24464.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24464.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24464","reference_id":"","reference_type":"","scores":[{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85052","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85035","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85037","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85005","published_at":"2026-04-16T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84944","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.8494","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84922","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85029","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85003","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.85006","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84984","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84988","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.8499","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84974","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02377","scoring_system":"epss","scoring_elements":"0.84967","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24464"},{"reference_url":"https://github.com/dotnet/announcements/issues/212","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/announcements/issues/212"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-cw98-9j8w-wxv9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-cw98-9j8w-wxv9"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIJGCVKLHVNLFBTEYJGWS43QG5DYJFBL","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIJGCVKLHVNLFBTEYJGWS43QG5DYJFBL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIJGCVKLHVNLFBTEYJGWS43QG5DYJFBL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIJGCVKLHVNLFBTEYJGWS43QG5DYJFBL/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRGSPXMZY4RM2L35FYHCXBFROLC23B2V","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRGSPXMZY4RM2L35FYHCXBFROLC23B2V"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRGSPXMZY4RM2L35FYHCXBFROLC23B2V/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRGSPXMZY4RM2L35FYHCXBFROLC23B2V/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OS2Q4NPRSARP7GHLKFLIYHFOPSYDO6MK","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OS2Q4NPRSARP7GHLKFLIYHFOPSYDO6MK"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OS2Q4NPRSARP7GHLKFLIYHFOPSYDO6MK/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OS2Q4NPRSARP7GHLKFLIYHFOPSYDO6MK/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061847","reference_id":"2061847","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061847"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24464","reference_id":"CVE-2022-24464","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24464"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24464","reference_id":"CVE-2022-24464","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24464"},{"reference_url":"https://github.com/advisories/GHSA-cw98-9j8w-wxv9","reference_id":"GHSA-cw98-9j8w-wxv9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cw98-9j8w-wxv9"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0826","reference_id":"RHSA-2022:0826","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0826"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0827","reference_id":"RHSA-2022:0827","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0827"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0828","reference_id":"RHSA-2022:0828","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0828"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0829","reference_id":"RHSA-2022:0829","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0829"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0830","reference_id":"RHSA-2022:0830","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0830"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0832","reference_id":"RHSA-2022:0832","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0832"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79647?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-m6bh-57h2-73a3"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-r5g1-zwbg-xubc"},{"vulnerability":"VCID-rz8f-jn6b-a7fw"},{"vulnerability":"VCID-ujyg-uwtg-vqbt"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.3"}],"aliases":["CVE-2022-24464","GHSA-cw98-9j8w-wxv9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ew2m-qrrh-dkbf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14378?format=json","vulnerability_id":"VCID-m6bh-57h2-73a3","summary":"This advisory has been marked as False-Positive and removed.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29117.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29117.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29117","reference_id":"","reference_type":"","scores":[{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84459","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84439","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84435","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84426","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.844","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84397","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84375","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84379","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84341","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84339","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84318","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84386","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84368","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02187","scoring_system":"epss","scoring_elements":"0.84363","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29117"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-3rq8-h3gj-r5c6","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-3rq8-h3gj-r5c6"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY/"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29117","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29117"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083647","reference_id":"2083647","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083647"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29117","reference_id":"CVE-2022-29117","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29117"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29117","reference_id":"CVE-2022-29117","reference_type":"","scores":[],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29117"},{"reference_url":"https://github.com/advisories/GHSA-3rq8-h3gj-r5c6","reference_id":"GHSA-3rq8-h3gj-r5c6","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3rq8-h3gj-r5c6"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2194","reference_id":"RHSA-2022:2194","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2194"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2195","reference_id":"RHSA-2022:2195","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2195"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2196","reference_id":"RHSA-2022:2196","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2196"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2199","reference_id":"RHSA-2022:2199","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2199"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2200","reference_id":"RHSA-2022:2200","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2200"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2202","reference_id":"RHSA-2022:2202","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2202"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:4588","reference_id":"RHSA-2022:4588","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:4588"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79601?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-r5g1-zwbg-xubc"},{"vulnerability":"VCID-rz8f-jn6b-a7fw"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.5"}],"aliases":["CVE-2022-29117","GHSA-3rq8-h3gj-r5c6"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m6bh-57h2-73a3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19474?format=json","vulnerability_id":"VCID-mf9a-cc9y-2yd3","summary":"# Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability\n\n## <a name=\"executive-summary\"></a>Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA Vulnerability exist in Microsoft.AspNetCore.Server.Kestrel.Core.dll where a dead-lock can occur resulting in Denial of Service.\n\n## Discussion\n\nDiscussion for this issue can be found at  https://github.com/dotnet/aspnetcore/issues/55714\n\n## <a name=\"mitigation-factors\"></a>Mitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n## <a name=\"affected-software\"></a>Affected software\n\n* Any .NET 7.0 application running on .NET 7.0.18 or earlier.\n* Any .NET 8.0 application running on .NET 8.0.4 or earlier.\n\n## <a name=\"affected-packages\"></a>Affected Packages\nThe vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below\n\n### <a name=\"ASP.NET 7\"></a>ASP.NET 7\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   |  <= 7.0.18 | 7.0.19\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   |  <= 7.0.18 | 7.0.19\n\n### <a name=\"ASP.NET 8\"></a>ASP.NET 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   |  <= 8.0.4 | 8.0.5\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   |  <= 8.0.4 | 8.0.5\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nIf you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-packages) or [affected packages](#affected-software), you're exposed to the vulnerability.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\n* To fix the issue please install the latest version of .NET 8.0 or .NET 7.0 or .NET 6.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.\n* If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the `dotnet --info` command. You will see output like the following;\n\n```\n.NET Core SDK (reflecting any global.json):\n\n\n Version:   8.0.200\n Commit:    8473146e7d\n\nRuntime Environment:\n\n OS Name:     Windows\n OS Version:  10.0.18363\n OS Platform: Windows\n RID:         win10-x64\n Base Path:   C:\\Program Files\\dotnet\\sdk\\6.0.300\\\n\nHost (useful for support):\n\n  Version: 8.0.3\n  Commit:  8473146e7d\n\n.NET Core SDKs installed:\n\n  8.0.200 [C:\\Program Files\\dotnet\\sdk]\n\n.NET Core runtimes installed:\n\n  Microsoft.AspAspNetCore.App 8.0.3 [C:\\Program Files\\dotnet\\shared\\Microsoft.AspAspNetCore.App]\n  Microsoft.AspNetCore.App 8.0.3 [C:\\Program Files\\dotnet\\shared\\Microsoft.AspNetCore.App]\n  Microsoft.WindowsDesktop.App 8.0.3 [C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App]\n\n\nTo install additional .NET Core runtimes or SDKs:\n  https://aka.ms/dotnet-download\n```\n\n* If you're using .NET 8.0, you should download and install .NET 8.0.5  Runtime or .NET 8.0.105 SDK (for Visual Studio 2022 v17.8) from https://dotnet.microsoft.com/download/dotnet-core/8.0.\n* If you're using .NET 7.0, you should download and install Runtime 7.0.19 or SDK 7.0.119 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0.\n\n.NET 7.0 and, .NET 8.0 updates are also available from Microsoft Update. To access this either type \"Check for updates\" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 8.0 or .NET 7.0 or .NET 6.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2024-30046]( https://www.cve.org/CVERecord?id=CVE-2024-30046)\n\n### Revisions\n\nV1.0 (May 14, 2024): Advisory published.\n\n_Version 1.0_\n\n_Last Updated 2024-05-14_","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-30046.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-30046.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-30046","reference_id":"","reference_type":"","scores":[{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39113","published_at":"2026-05-05T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39237","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39319","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39334","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39551","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39621","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39612","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39634","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39606","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39514","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39598","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39628","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39577","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.39593","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0018","scoring_system":"epss","scoring_elements":"0.3963","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-30046"},{"reference_url":"https://github.com/dotnet/announcements/issues/308","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/announcements/issues/308"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/issues/55714","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/issues/55714"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-hhc7-x9w4-cw47","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-hhc7-x9w4-cw47"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30046","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-15T16:43:57Z/"}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30046"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30046","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30046"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279697","reference_id":"2279697","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279697"},{"reference_url":"https://github.com/advisories/GHSA-hhc7-x9w4-cw47","reference_id":"GHSA-hhc7-x9w4-cw47","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hhc7-x9w4-cw47"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:2842","reference_id":"RHSA-2024:2842","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:2842"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:2843","reference_id":"RHSA-2024:2843","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:2843"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3340","reference_id":"RHSA-2024:3340","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3340"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3345","reference_id":"RHSA-2024:3345","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3345"},{"reference_url":"https://usn.ubuntu.com/6773-1/","reference_id":"USN-6773-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6773-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60589?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.19","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.19"},{"url":"http://public2.vulnerablecode.io/api/packages/60591?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d8a6-efmq-q3hd"},{"vulnerability":"VCID-dmdd-h655-3keb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.5"}],"aliases":["CVE-2024-30046","GHSA-hhc7-x9w4-cw47"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mf9a-cc9y-2yd3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52224?format=json","vulnerability_id":"VCID-r5g1-zwbg-xubc","summary":".NET Denial of Service Vulnerability\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding.\n\n## <a name=\"affected-software\"></a>Affected software\n* Any .NET 6.0 application running on .NET 6.0.8 or earlier.\n* Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier.\nIf your application uses the following package versions, ensure you update to the latest version of .NET.\n### <a name=\"ASP.NET Core 3.1\"></a>.NET Core 3.1\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 3.1.5, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 3.1.0, < 3.1.29|3.1.29\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 3.1.0, < 3.1.29|3.1.29\n### <a name=\".NET 6\"></a>.NET 6\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)|>= 5.0.1, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)|>= 6.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)|>= 5.0.0, < 6.0.9|6.0.9\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)|>= 5.0.0, < 6.0.9|6.0.9\n\n\n\n### Other\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/234\nAn Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43953\nMSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38013.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38013.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-38013","reference_id":"","reference_type":"","scores":[{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78332","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78325","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78299","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78293","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78267","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78285","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78254","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78395","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78382","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78366","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78359","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78327","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.7833","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78303","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78307","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-38013"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r8m2-4x37-6592","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r8m2-4x37-6592"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38013","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38013"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38013","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38013"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125124","reference_id":"2125124","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125124"},{"reference_url":"https://github.com/advisories/GHSA-r8m2-4x37-6592","reference_id":"GHSA-r8m2-4x37-6592","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r8m2-4x37-6592"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6520","reference_id":"RHSA-2022:6520","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6520"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6521","reference_id":"RHSA-2022:6521","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6521"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6522","reference_id":"RHSA-2022:6522","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6522"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6523","reference_id":"RHSA-2022:6523","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6523"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6539","reference_id":"RHSA-2022:6539","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6539"},{"reference_url":"https://usn.ubuntu.com/5609-1/","reference_id":"USN-5609-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5609-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80066?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.9"}],"aliases":["CVE-2022-38013","GHSA-r8m2-4x37-6592"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r5g1-zwbg-xubc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15466?format=json","vulnerability_id":"VCID-rz8f-jn6b-a7fw","summary":".NET Information Disclosure Vulnerability\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nAn information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.\n\n## <a name=\"affected-software\"></a>Affected software\n\n* Any .NET 6.0 application running on .NET 6.0.7 or earlier.\n* Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.\n\nIf your application uses the following package versions, ensure you update to the latest version of .NET.\n\n### <a name=\".NET Core 3.1\"></a>.NET Core 3.1\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[System.Security.Cryptography.Xml](http://system.security)| <=4.7.0| 4.7.1\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)| >=3.1.0, 3.1.27| 3.1.28\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)| >=3.1.0, 3.1.27| 3.1.28\n\n### <a name=\".NET 6\"></a>.NET 6\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml)| >=5.0.0, 6.0.0| 6.0.1\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64)| >=6.0.0, 6.0.7| 6.0.8\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)| >=6.0.0, 6.0.7| 6.0.8\n\n## Patches\n\n\n* If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.\n* If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.\n\n\n### Other\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/232\nAn Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43166\nMSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34716.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34716.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-34716","reference_id":"","reference_type":"","scores":[{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76469","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76455","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76449","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76415","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76431","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76425","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00952","scoring_system":"epss","scoring_elements":"0.76385","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78053","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78082","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78064","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.7809","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78094","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78121","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78103","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-34716"},{"reference_url":"https://github.com/dotnet/announcements/issues/232","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/announcements/issues/232"},{"reference_url":"https://github.com/dotnet/aspnetcore/issues/43166","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/issues/43166"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-vh55-786g-wjwj","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-vh55-786g-wjwj"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"},{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-29T20:04:18Z/"}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34716","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34716"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34716","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34716"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115183","reference_id":"2115183","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115183"},{"reference_url":"https://github.com/advisories/GHSA-vh55-786g-wjwj","reference_id":"GHSA-vh55-786g-wjwj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vh55-786g-wjwj"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6037","reference_id":"RHSA-2022:6037","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6037"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6038","reference_id":"RHSA-2022:6038","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6038"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6043","reference_id":"RHSA-2022:6043","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6043"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6057","reference_id":"RHSA-2022:6057","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6057"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6058","reference_id":"RHSA-2022:6058","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6058"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54538?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-r5g1-zwbg-xubc"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.8"}],"aliases":["CVE-2022-34716","GHSA-vh55-786g-wjwj","GMS-2024-75","GMS-2024-76","GMS-2024-77","GMS-2024-78","GMS-2024-79","GMS-2024-80","GMS-2024-81","GMS-2024-82","GMS-2024-83","GMS-2024-84","GMS-2024-85","GMS-2024-86","GMS-2024-90"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rz8f-jn6b-a7fw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14377?format=json","vulnerability_id":"VCID-ujyg-uwtg-vqbt","summary":"Uncontrolled Resource Consumption\n.NET, Visual Studio and PowerShell Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117, CVE-2022-29145.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23267.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23267.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23267","reference_id":"","reference_type":"","scores":[{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92227","published_at":"2026-05-05T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92219","published_at":"2026-04-26T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92216","published_at":"2026-04-29T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92203","published_at":"2026-04-13T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92197","published_at":"2026-04-08T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92186","published_at":"2026-04-07T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92182","published_at":"2026-04-04T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92176","published_at":"2026-04-02T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92213","published_at":"2026-04-18T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92214","published_at":"2026-04-16T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.92206","published_at":"2026-04-12T12:55:00Z"},{"value":"0.08193","scoring_system":"epss","scoring_elements":"0.922","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23267"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dotnet/announcements/issues/221","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/announcements/issues/221"},{"reference_url":"https://github.com/dotnet/runtime/security/advisories/GHSA-485p-mrj5-8w2v","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/runtime/security/advisories/GHSA-485p-mrj5-8w2v"},{"reference_url":"https://github.com/PowerShell/Announcements/issues/32","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/PowerShell/Announcements/issues/32"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5FPEQ6BTYRGTS6IYCDTZW6YF5HLQ3BY"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23267","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23267"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083650","reference_id":"2083650","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083650"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23267","reference_id":"CVE-2022-23267","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23267"},{"reference_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23267","reference_id":"CVE-2022-23267","reference_type":"","scores":[],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23267"},{"reference_url":"https://github.com/advisories/GHSA-485p-mrj5-8w2v","reference_id":"GHSA-485p-mrj5-8w2v","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-485p-mrj5-8w2v"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2194","reference_id":"RHSA-2022:2194","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2194"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2195","reference_id":"RHSA-2022:2195","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2195"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2196","reference_id":"RHSA-2022:2196","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2196"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2199","reference_id":"RHSA-2022:2199","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2199"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2200","reference_id":"RHSA-2022:2200","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2200"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:2202","reference_id":"RHSA-2022:2202","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:2202"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:4588","reference_id":"RHSA-2022:4588","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:4588"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79601?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-dp82-cuxf-9yhq"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"},{"vulnerability":"VCID-r5g1-zwbg-xubc"},{"vulnerability":"VCID-rz8f-jn6b-a7fw"},{"vulnerability":"VCID-ysmy-fhmq-ffdu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.5"}],"aliases":["CVE-2022-23267","GHSA-485p-mrj5-8w2v"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ujyg-uwtg-vqbt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/29350?format=json","vulnerability_id":"VCID-uxus-gdkx-xudj","summary":"# Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability\n\n## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 9.0, ASP.NET Core 8.0, ASP.NET Core 6.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.\n\nA vulnerability exists in ASP.NET Core applications calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/348\n\n### Mitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n## Affected software\n\n* Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.2 or earlier.\n* Any ASP.NET Core application running on ASP.NET Core 8.0.13 or earlier.\n* Any ASP.NET Core application running on ASP.NET Core 6.0.36 or earlier.\n* Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Identity version 2.3.0 or earlier.\n\n## Affected Packages\n\nThe vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below\n\n| Package name | Affected version | Patched version |\n| --- | --- | --- |\n| [Microsoft.AspNetCore.Identity](https://www.nuget.org/packages/Microsoft.AspNetCore.Identity) | 2.3.0 | 2.3.1 |\n\n### ASP.NET Core 9\n\n| Package name | Affected version | Patched version |\n| --- | --- | --- |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n| [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.2 | 9.0.3 |\n\n### ASP.NET Core 8\n\n| Package name | Affected version | Patched version |\n| --- | --- | --- |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n| [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.13 | 8.0.14 |\n\n### ASP.NET Core 6\n\n| Package name | Affected version | Patched version |\n| --- | --- | --- |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 6.0.0, <= 6.0.36 | none |\n| [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 6.0.0, <= 6.0.36 | none |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-software) or [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 9.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version.\n\n* You can list the versions you have installed by running the `dotnet --info` command. You will see output like the following:\n\n```\n.NET SDK:\n Version:           9.0.100\n Commit:            59db016f11\n Workload version:  9.0.100-manifests.3068a692\n MSBuild version:   17.12.7+5b8665660\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  15.2\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /usr/local/share/dotnet/sdk/9.0.100/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use loose manifests when installing new manifests.\n\nHost:\n  Version:      9.0.0\n  Architecture: arm64\n  Commit:       9d5a6a9aa4\n\n.NET SDKs installed:\n  9.0.100 [/usr/local/share/dotnet/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  x64   [/usr/local/share/dotnet]\n    registered at [/etc/dotnet/install_location_x64]\n\nEnvironment variables:\n  Not set\n\nglobal.json file:\n  Not found\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n```\n\n* If you're using .NET 9.0, you should download and install .NET 9.0.3 Runtime or .NET 9.0.103 SDK (for Visual Studio 2022 v17.12 latest Preview) from https://dotnet.microsoft.com/download/dotnet-core/9.0.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 8.0 or .NET 9.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n### Acknowledgement\n\nZahid TOKAT\n\n[CVE-2025-24070](https://www.cve.org/CVERecord?id=CVE-2025-24070)","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24070","reference_id":"","reference_type":"","scores":[{"value":"0.00279","scoring_system":"epss","scoring_elements":"0.51203","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00279","scoring_system":"epss","scoring_elements":"0.51258","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00279","scoring_system":"epss","scoring_elements":"0.51296","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00279","scoring_system":"epss","scoring_elements":"0.51289","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00279","scoring_system":"epss","scoring_elements":"0.51342","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.5497","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54944","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54939","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54989","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54988","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54982","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54959","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54996","published_at":"2026-04-16T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24070"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","reference_id":"","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C"},{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-11T18:23:50Z/"}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24070","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24070"},{"reference_url":"https://www.herodevs.com/vulnerability-directory/cve-2025-24070","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-24070"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349733","reference_id":"2349733","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349733"},{"reference_url":"https://github.com/advisories/GHSA-2865-hh9g-w894","reference_id":"GHSA-2865-hh9g-w894","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2865-hh9g-w894"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:2666","reference_id":"RHSA-2025:2666","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:2666"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:2667","reference_id":"RHSA-2025:2667","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:2667"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:2668","reference_id":"RHSA-2025:2668","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:2668"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:2669","reference_id":"RHSA-2025:2669","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:2669"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:2670","reference_id":"RHSA-2025:2670","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:2670"},{"reference_url":"https://usn.ubuntu.com/7345-1/","reference_id":"USN-7345-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7345-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70220?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d8a6-efmq-q3hd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.14"},{"url":"http://public2.vulnerablecode.io/api/packages/70219?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@9.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d8a6-efmq-q3hd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@9.0.3"}],"aliases":["CVE-2025-24070","GHSA-2865-hh9g-w894"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uxus-gdkx-xudj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15054?format=json","vulnerability_id":"VCID-ysmy-fhmq-ffdu","summary":"# Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability\n\n## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET 6.0, ASP.NET 7.0 and, ASP.NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.\n\nA vulnerability exists in ASP.NET applications using SignalR where a malicious client can result in a denial-of-service.\n\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/295\n\n### Mitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n## Affected software\n\n* Any .NET 6.0 application running on .NET 6.0.26 or earlier.\n* Any .NET 7.0 application running on .NET 7.0.15 or earlier.\n* Any .NET 8.0 application running on .NET 8.0.1 or earlier.\n\n## Affected Packages\nThe vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below\n\n### ASP.NET 6.0\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   |  <= 6.0.26 | 6.0.27\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   |  <= 6.0.26 | 6.0.27\n\n\n\n### ASP.NET 7.0\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   |  <= 7.0.15 | 7.0.16\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   |  <= 7.0.15 | 7.0.16\n\n### ASP.NET 8.0\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   |  <= 8.0.1 | 8.0.2\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   |  <= 8.0.1 | 8.0.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-software) or [affected packages](#affected-packages) , you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n* To fix the issue please install the latest version of .NET 8.0 or .NET 7.0 or .NET 6.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.\n* If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the `dotnet --info` command. You will see output like the following;\n\n```\n.NET Core SDK (reflecting any global.json):\n\n Version:   6.0.200\n Commit:    8473146e7d\n\nRuntime Environment:\n\n OS Name:     Windows\n OS Version:  10.0.18363\n OS Platform: Windows\n RID:         win10-x64\n Base Path:   C:\\Program Files\\dotnet\\sdk\\6.0.300\\\n\nHost (useful for support):\n\n  Version: 6.0.5\n  Commit:  8473146e7d\n\n.NET Core SDKs installed:\n\n  6.0.200 [C:\\Program Files\\dotnet\\sdk]\n\n.NET Core runtimes installed:\n\n  Microsoft.AspNetCore.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App]\n  Microsoft.WindowsDesktop.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App]\n\nTo install additional .NET Core runtimes or SDKs:\n  https://aka.ms/dotnet-download\n```\n\n* If you're using .NET 8.0, you should download and install .NET 8.0.2  Runtime or .NET 8.0.102 SDK (for Visual Studio 2022 v17.8) from https://dotnet.microsoft.com/download/dotnet-core/8.0.\n* If you're using .NET 7.0, you should download and install Runtime 7.0.16 or SDK 7.0.116 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0.\n* If you're using .NET 6.0, you should download and install Runtime 6.0.27 or SDK 6.0.419 from https://dotnet.microsoft.com/download/dotnet-core/6.0.\n\n.NET 6.0, .NET 7.0 and, .NET 8.0 updates are also available from Microsoft Update. To access this either type \"Check for updates\" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 8.0 or .NET 7.0 or .NET 6.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2024-21386]( https://www.cve.org/CVERecord?id=CVE-2024-21386)\n\n### Revisions\n\nV1.0 (February 13, 2024): Advisory published.\n\n_Version 1.0_\n\n_Last Updated 2024-02-13_","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21386.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21386.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21386","reference_id":"","reference_type":"","scores":[{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84589","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84581","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84555","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84554","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84553","published_at":"2026-04-16T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84533","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84537","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84542","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84523","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84517","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84496","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84495","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02231","scoring_system":"epss","scoring_elements":"0.84476","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02393","scoring_system":"epss","scoring_elements":"0.85103","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02393","scoring_system":"epss","scoring_elements":"0.85088","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21386"},{"reference_url":"https://github.com/dotnet/aspnetcore","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore"},{"reference_url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-g74q-5xw3-j7q9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-g74q-5xw3-j7q9"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21386","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T20:15:43Z/"}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21386"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21386","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21386"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263085","reference_id":"2263085","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263085"},{"reference_url":"https://github.com/advisories/GHSA-g74q-5xw3-j7q9","reference_id":"GHSA-g74q-5xw3-j7q9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g74q-5xw3-j7q9"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0805","reference_id":"RHSA-2024:0805","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0805"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0806","reference_id":"RHSA-2024:0806","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0806"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0807","reference_id":"RHSA-2024:0807","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0807"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0808","reference_id":"RHSA-2024:0808","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0808"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0814","reference_id":"RHSA-2024:0814","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0814"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0827","reference_id":"RHSA-2024:0827","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0827"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0848","reference_id":"RHSA-2024:0848","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0848"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:2843","reference_id":"RHSA-2024:2843","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:2843"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3340","reference_id":"RHSA-2024:3340","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3340"},{"reference_url":"https://usn.ubuntu.com/6634-1/","reference_id":"USN-6634-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6634-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52918?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.27","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-mf9a-cc9y-2yd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.27"},{"url":"http://public2.vulnerablecode.io/api/packages/52947?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-mf9a-cc9y-2yd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@7.0.16"},{"url":"http://public2.vulnerablecode.io/api/packages/53029?format=json","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d8a6-efmq-q3hd"},{"vulnerability":"VCID-dmdd-h655-3keb"},{"vulnerability":"VCID-mf9a-cc9y-2yd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@8.0.2"}],"aliases":["CVE-2024-21386","GHSA-g74q-5xw3-j7q9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ysmy-fhmq-ffdu"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64@6.0.0"}