CVE-2026-96236

HIGH 7.5

Published 2026-10-13 · Last modified 2026-10-25

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.1%chance of exploitation in 30 days · 65th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

Vendors Microsoft

Products Asp.Net Core 10.0 Asp.Net Core 11.0 Asp.Net Core 8.0 Asp.Net Core 9.0 Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10

Weakness (CWE)

CWE-770: : Allocation of Resources Without Limits or Throttling

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

Microsoft.AspNetCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4g7-52wc-p8x7/GHSA-f4g7-52wc-p8x7.json"
  }
}
```
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z

Vendor product assessments

Showing 32 of 1306 vendor product statements; 1274 omitted. Read the full vendor advisory.

aspnetcore-runtime-8.0-0:8.0.32-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-host-debuginfo-0:9.0.21-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-8.0-debuginfo-0:8.0.132-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet9.0-debugsource-0:9.0.122-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-apphost-pack-10.0-debuginfo-0:10.0.13-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-hostfxr-9.0-0:9.0.21-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-10.0-debuginfo-0:10.0.113-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-targeting-pack-9.0-0:9.0.21-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
aspnetcore-runtime-9.0-0:9.0.21-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-apphost-pack-9.0-0:9.0.21-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-runtime-9.0-0:9.0.21-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-aot-10.0-debuginfo-0:10.0.113-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet10.0-debugsource-0:10.0.113-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-host-0:8.0.32-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_4?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-templates-8.0-0:8.0.132-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_4?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-runtime-8.0-debuginfo-0:8.0.32-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_6?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
aspnetcore-runtime-9.0-0:9.0.21-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-apphost-pack-9.0-debuginfo-0:9.0.21-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-runtime-8.0-0:8.0.32-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-9.0-debuginfo-0:9.0.122-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet10.0-0:10.0.113-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=src
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-hostfxr-8.0-debuginfo-0:8.0.32-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-apphost-pack-9.0-debuginfo-0:9.0.21-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-8.0-source-built-artifacts-0:8.0.132-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-hostfxr-9.0-debuginfo-0:9.0.21-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet10.0-debuginfo-0:10.0.113-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet8.0-debugsource-0:8.0.132-1.el9_6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_6?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet-sdk-10.0-source-built-artifacts-0:10.0.113-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet9.0-debugsource-0:9.0.122-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet10.0.src as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: component not present

pkg:rpm/redhat/dotnet10.0?arch=src
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet8.0.src as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: component not present

pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
dotnet9.0.src as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: component not present

pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00

All CVSS metrics

HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96236 vendor-advisorypatchWEBCVE record · microsoft · Updated 2026-10-25T18:43:25.900Z
NVD · CVE-2026-96236 · Updated 2026-10-13T20:19:15.027
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z

Advisories

https://osv.dev/vulnerability/GHSA-f4g7-52wc-p8x7 ADVISORYGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
https://nvd.nist.gov/vuln/detail/CVE-2026-96236 ADVISORYvendor-referenceGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
Red Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96236.json vendor-advisoryRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99753 ADVISORYEUVD · EUVD-2026-99753

Technical & other

https://github.com/dotnet/aspnetcore/security/advisories/GHSA-f4g7-52wc-p8x7 WEBGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
https://github.com/dotnet/announcements/issues/484 WEBGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
https://github.com/dotnet/aspnetcore PACKAGEGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
https://github.com/dotnet/aspnetcore/discussions/69803 WEBGitHub Advisory Database · GHSA-f4g7-52wc-p8x7
GitHub Advisory Database · GHSA-f4g7-52wc-p8x7 · Updated 2026-10-19T19:30:32.109979772Z
https://access.redhat.com/security/cve/CVE-2026-96236 vendor-referenceRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://bugzilla.redhat.com/show_bug.cgi?id=2548807 vendor-referenceRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://www.cve.org/CVERecord?id=CVE-2026-96236 vendor-referenceRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:88474 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:88424 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86195 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86172 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86170 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86192 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:88425 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:88422 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86171 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86169 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86193 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86168 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00
https://access.redhat.com/errata/RHSA-2026:86594 vendor-remediationRed Hat · CVE-2026-96236 · Updated 2026-10-23T04:25:03+00:00

Sources: NVD · CVE.org · EPSS