Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
\n", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Mar" }, { "category": "description", "text": "Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-26130" }, { "category": "description", "text": "# Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability\n\n## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/385\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Severity:** High\n- **Weakness:** CWE-770 (Uncontrolled Resource Consumption)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Affected Products\n\n### .NET 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.24 | 8.0.25\n\n\n### .NET 9\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.13 | 9.0.14\n\n### .NET 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.3 | 10.0.4\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using an affected package listed in [affected products](#affected-products) or [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 8.0, NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command. \n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-26130]( https://www.cve.org/CVERecord?id=CVE-2026-26130)\n\n### Acknowledgements\n\nBartłomiej Dach\n\n### Revisions\n\nV1.0 (March 10, 2026): Advisory published.", "title": "github - https://github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-26130" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4456" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4454" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4443" }, { "category": "description", "text": "# Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability\n\n## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/385\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Severity:** High\n- **Weakness:** CWE-770 (Uncontrolled Resource Consumption)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Affected Products\n\n### .NET 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.24 | 8.0.25\n\n\n### .NET 9\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.13 | 9.0.14\n\n### .NET 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.3 | 10.0.4\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using an affected package listed in [affected products](#affected-products) or [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 8.0, NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command. \n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-26130]( https://www.cve.org/CVERecord?id=CVE-2026-26130)\n\n### Acknowledgements\n\nBartłomiej Dach\n\n### Revisions\n\nV1.0 (March 10, 2026): Advisory published.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/NuGet%2FGHSA-4vgm-c2wm-63mw.json?alt=media" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4450" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4453" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4451" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4455" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4458" }, { "category": "description", "text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:4445" }, { "category": "description", "text": "It was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not\nproperly handle certain malformed Base64Url encoded input. An attacker could\npossibly use this issue to cause .NET to crash, resulting in a denial of\nservice. This issue only affected .NET 9.0 and .NET 10.0. (CVE-2026-26127)\n\nBartłomiej Dach discovered that .NET's SignalR server component did not\nproperly manage resource consumption when processing certain messages. An\nattacker could possibly use this issue to exhaust internal buffers, resulting\nin a denial of service. (CVE-2026-26130)", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Ubuntu%2FUSN-8085-1.json?alt=media" }, { "category": "description", "text": "# Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability\n\n## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/385\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Severity:** High\n- **Weakness:** CWE-770 (Uncontrolled Resource Consumption)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Affected Products\n\n### .NET 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, < =8.0.24 | 8.0.25\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.24 | 8.0.25\n\n\n### .NET 9\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, < =9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.13 | 9.0.14\n\n### .NET 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, < =10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.3 | 10.0.4\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using an affected package listed in [affected products](#affected-products) or [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 8.0, NET 9.0, or .NET 10.0, as appropriate. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command. \n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-26130]( https://www.cve.org/CVERecord?id=CVE-2026-26130)\n\n### Acknowledgements\n\nBartłomiej Dach\n\n### Revisions\n\nV1.0 (March 10, 2026): Advisory published.", "title": "github - https://api.github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "description", "text": "Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26130.json" }, { "category": "description", "text": "Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-26130" }, { "category": "other", "text": "0.00704", "title": "EPSS" }, { "category": "other", "text": "7.4", "title": "NCSC Score" }, { "category": "other", "text": "There is news data available from source Bleepingcomputer, There is product data available from a private source, VENDOR FIX as product remediation category, There is product data available from source Certbundde, IMPACT as product threat category, There is cvss data available from a private source", "title": "NCSC Score top increasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-1432758", "CSAFPID-5811516", "CSAFPID-5811517", "CSAFPID-5811518", "CSAFPID-5811519", "CSAFPID-5811520", "CSAFPID-5811521", "CSAFPID-5811522", "CSAFPID-5811523", "CSAFPID-5811524", "CSAFPID-5811525", "CSAFPID-5811526", "CSAFPID-5811527", "CSAFPID-5811528", "CSAFPID-5811529", "CSAFPID-5811530", "CSAFPID-5811531", "CSAFPID-5811532", "CSAFPID-5811533", "CSAFPID-5811534", "CSAFPID-5811535", "CSAFPID-5811536", "CSAFPID-5811537", "CSAFPID-5811576", "CSAFPID-5811577", "CSAFPID-5811578", "CSAFPID-5811579", "CSAFPID-5811580", "CSAFPID-5811581", "CSAFPID-5811582", "CSAFPID-5811583", "CSAFPID-5811584", "CSAFPID-5811585", "CSAFPID-5811586", "CSAFPID-5811587", "CSAFPID-5811588", "CSAFPID-5811589", "CSAFPID-5811590", "CSAFPID-5811591", "CSAFPID-5811592", "CSAFPID-5811593", "CSAFPID-5811594", "CSAFPID-1432908", "CSAFPID-5811660", "CSAFPID-5811661", "CSAFPID-5811662", "CSAFPID-5811663", "CSAFPID-5811664", "CSAFPID-5811665", "CSAFPID-5811666", "CSAFPID-5811667", "CSAFPID-5811668", "CSAFPID-5811669", "CSAFPID-5811670", "CSAFPID-5811671", "CSAFPID-5811672", "CSAFPID-5811673", "CSAFPID-5811674", "CSAFPID-5811675", "CSAFPID-5811676", "CSAFPID-5811677", "CSAFPID-5811678", "CSAFPID-5811679", "CSAFPID-5811680", "CSAFPID-5811681", "CSAFPID-5180289", "CSAFPID-5813838", "CSAFPID-5813839", "CSAFPID-5813840", "CSAFPID-5813841", "CSAFPID-5813842", "CSAFPID-5813843", "CSAFPID-5813844", "CSAFPID-5813845", "CSAFPID-5813846", "CSAFPID-5813847", "CSAFPID-5813848", "CSAFPID-5813849", "CSAFPID-5813850", "CSAFPID-5813851", "CSAFPID-5813852", "CSAFPID-5813853", "CSAFPID-5813854", "CSAFPID-5813855", "CSAFPID-5813856", "CSAFPID-5813857", "CSAFPID-5813858", "CSAFPID-5813859", "CSAFPID-5813860", "CSAFPID-5813861", "CSAFPID-5813862", "CSAFPID-5813863", "CSAFPID-5813864", "CSAFPID-5813865", "CSAFPID-5813866", "CSAFPID-5813867", "CSAFPID-5813868", "CSAFPID-5813869", "CSAFPID-5813870", "CSAFPID-5813871", "CSAFPID-5813872", "CSAFPID-5813873", "CSAFPID-5813874", "CSAFPID-5813875", "CSAFPID-5813876", "CSAFPID-5813877", "CSAFPID-5813878", "CSAFPID-5813879", "CSAFPID-5813880", "CSAFPID-5813909", "CSAFPID-5813910", "CSAFPID-5813911", "CSAFPID-5813912", "CSAFPID-5813913", "CSAFPID-5813914", "CSAFPID-5813915", "CSAFPID-5813916", "CSAFPID-5813917", "CSAFPID-5813918", "CSAFPID-5813919", "CSAFPID-5813920", "CSAFPID-5813921", "CSAFPID-5813922", "CSAFPID-5813923", "CSAFPID-5813924", "CSAFPID-5813925", "CSAFPID-5813926", "CSAFPID-5813943", "CSAFPID-5813944", "CSAFPID-5813945", "CSAFPID-5813946", "CSAFPID-5813947", "CSAFPID-5813948", "CSAFPID-5813949", "CSAFPID-5813950", "CSAFPID-5813951", "CSAFPID-5813952", "CSAFPID-5813953", "CSAFPID-5813954", "CSAFPID-5813955", "CSAFPID-5813956", "CSAFPID-5813957", "CSAFPID-5813958", "CSAFPID-5813959", "CSAFPID-5813960", "CSAFPID-5813961", "CSAFPID-5813968", "CSAFPID-5813969", "CSAFPID-5813970", "CSAFPID-5813971", "CSAFPID-5813972", "CSAFPID-5813973", "CSAFPID-5813974", "CSAFPID-5813975", "CSAFPID-5813976", "CSAFPID-5813977", "CSAFPID-5813978", "CSAFPID-5813979", "CSAFPID-5813980", "CSAFPID-5813981", "CSAFPID-5813982", "CSAFPID-5813983", "CSAFPID-5813984", "CSAFPID-5813985", "CSAFPID-5813986", "CSAFPID-5813987", "CSAFPID-5813988", "CSAFPID-5813989", "CSAFPID-5813990", "CSAFPID-5813991", "CSAFPID-5814507", "CSAFPID-5814508", "CSAFPID-5814509", "CSAFPID-5814510", "CSAFPID-5814511", "CSAFPID-5814512", "CSAFPID-5814513", "CSAFPID-5814514", "CSAFPID-5814515", "CSAFPID-5814516", "CSAFPID-5814517", "CSAFPID-5814518", "CSAFPID-5814519", "CSAFPID-5814520", "CSAFPID-5814521", "CSAFPID-5814522", "CSAFPID-5814523", "CSAFPID-5814524", "CSAFPID-5814525", "CSAFPID-5814526", "CSAFPID-5814527", "CSAFPID-5814528", "CSAFPID-5814529" ], "known_affected": [ "CSAFPID-5775348", "CSAFPID-5775349", "CSAFPID-5775350", "CSAFPID-2467377", "CSAFPID-2467378", "CSAFPID-5774218", "CSAFPID-2470409", "CSAFPID-2470410", "CSAFPID-5793557", "CSAFPID-1317175", "CSAFPID-5810232", "CSAFPID-5810233", "CSAFPID-1439317", "CSAFPID-1439319", "CSAFPID-5183811", "CSAFPID-5811171", "CSAFPID-5811173", "CSAFPID-5811175", "CSAFPID-5811178", "CSAFPID-5811180", "CSAFPID-5811182", "CSAFPID-5811184", "CSAFPID-5811186", "CSAFPID-5811188", "CSAFPID-1317177", "CSAFPID-1330299", "CSAFPID-5535100", "CSAFPID-5535101", "CSAFPID-5535102", "CSAFPID-5535103", "CSAFPID-5535104", "CSAFPID-5535105", "CSAFPID-5535106", "CSAFPID-5535107", "CSAFPID-5535108", "CSAFPID-5535109", "CSAFPID-5535111", "CSAFPID-5535112", "CSAFPID-5535113", "CSAFPID-5535114", "CSAFPID-5535115", "CSAFPID-5535116", "CSAFPID-5535117", "CSAFPID-5535118", "CSAFPID-5535119", "CSAFPID-5535120", "CSAFPID-5535122", "CSAFPID-5535123", "CSAFPID-5535124", "CSAFPID-5535125", "CSAFPID-5535126", "CSAFPID-5535127", "CSAFPID-5535128", "CSAFPID-5535129", "CSAFPID-5535130", "CSAFPID-5535131", "CSAFPID-5535133", "CSAFPID-5535134", "CSAFPID-5535135", "CSAFPID-5535136", "CSAFPID-5535137", "CSAFPID-5535138", "CSAFPID-5535139", "CSAFPID-5535140", "CSAFPID-5535141", "CSAFPID-5535142", "CSAFPID-5535144", "CSAFPID-5535145", "CSAFPID-5535146", "CSAFPID-5535147", "CSAFPID-5535148", "CSAFPID-5535149", "CSAFPID-5535150", "CSAFPID-5535151", "CSAFPID-5535152", "CSAFPID-5535153", "CSAFPID-5535155", "CSAFPID-5535156", "CSAFPID-5535157", "CSAFPID-5535158", "CSAFPID-5535159", "CSAFPID-5535160", "CSAFPID-5535161", "CSAFPID-5535162", "CSAFPID-5535163", "CSAFPID-5535164", "CSAFPID-5535166", "CSAFPID-5535167", "CSAFPID-5535168", "CSAFPID-5535169", "CSAFPID-5535170", "CSAFPID-5535171", "CSAFPID-5535172", "CSAFPID-5535173", "CSAFPID-5535174", "CSAFPID-5535175", "CSAFPID-5535177", "CSAFPID-5535178", "CSAFPID-5535179", "CSAFPID-5535180", "CSAFPID-5535181", "CSAFPID-5535182", "CSAFPID-5535183", "CSAFPID-5535184", "CSAFPID-5535185", "CSAFPID-5535186", "CSAFPID-5535189", "CSAFPID-5535190", "CSAFPID-5535191", "CSAFPID-5535192", "CSAFPID-5535193", "CSAFPID-5535194", "CSAFPID-5535195", "CSAFPID-5535196", "CSAFPID-5535197", "CSAFPID-5535198", "CSAFPID-5535200", "CSAFPID-5535201", "CSAFPID-5535202", "CSAFPID-5535203", "CSAFPID-5535204", "CSAFPID-5535205", "CSAFPID-5535206", "CSAFPID-5535207", "CSAFPID-5535208", "CSAFPID-5535209", "CSAFPID-5535211", "CSAFPID-5535212", "CSAFPID-5535213", "CSAFPID-5535214", "CSAFPID-5535215", "CSAFPID-5535216", "CSAFPID-5535217", "CSAFPID-5535218", "CSAFPID-5535219", "CSAFPID-5535220", "CSAFPID-5535222", "CSAFPID-5535223", "CSAFPID-5535224", "CSAFPID-5535225", "CSAFPID-5535226", "CSAFPID-5535227", "CSAFPID-5535228", "CSAFPID-5535229", "CSAFPID-5535230", "CSAFPID-5535231", "CSAFPID-5535232", "CSAFPID-5535233", "CSAFPID-5535234", "CSAFPID-5535235", "CSAFPID-5535236", "CSAFPID-5535237", "CSAFPID-5535238", "CSAFPID-5535239", "CSAFPID-5535240", "CSAFPID-5535241", "CSAFPID-5535243", "CSAFPID-5535244", "CSAFPID-5535245", "CSAFPID-5535246", "CSAFPID-5535247", "CSAFPID-5535248", "CSAFPID-5535249", "CSAFPID-5535250", "CSAFPID-5535251", "CSAFPID-5535252", "CSAFPID-5535253", "CSAFPID-5535254", "CSAFPID-5535255", "CSAFPID-5535256", "CSAFPID-5535257", "CSAFPID-5535258", "CSAFPID-5535259", "CSAFPID-5535260", "CSAFPID-5535261", "CSAFPID-5535262", "CSAFPID-5535264", "CSAFPID-5535265", "CSAFPID-5535266", "CSAFPID-5535267", "CSAFPID-5535268", "CSAFPID-5535269", "CSAFPID-5535270", "CSAFPID-5535271", "CSAFPID-5535272", "CSAFPID-5535273", "CSAFPID-5535274", "CSAFPID-5535275", "CSAFPID-5535276", "CSAFPID-5535277", "CSAFPID-5535278", "CSAFPID-5535279", "CSAFPID-5535280", "CSAFPID-5535281", "CSAFPID-5535282", "CSAFPID-5535283", "CSAFPID-5535285", "CSAFPID-5535286", "CSAFPID-5535287", "CSAFPID-5535288", "CSAFPID-5535289", "CSAFPID-5535290", "CSAFPID-5535291", "CSAFPID-5535292", "CSAFPID-5535293", "CSAFPID-5535294", "CSAFPID-5535295", "CSAFPID-5535296", "CSAFPID-5535297", "CSAFPID-5535298", "CSAFPID-5535299", "CSAFPID-5535300", "CSAFPID-5535301", "CSAFPID-5535302", "CSAFPID-5535303", "CSAFPID-5535304", "CSAFPID-5535306", "CSAFPID-5535307", "CSAFPID-5535308", "CSAFPID-5535309", "CSAFPID-5535310", "CSAFPID-5535311", "CSAFPID-5535312", "CSAFPID-5535313", "CSAFPID-5535314", "CSAFPID-5535315", "CSAFPID-5535316", "CSAFPID-5535317", "CSAFPID-5535318", "CSAFPID-5535319", "CSAFPID-5535320", "CSAFPID-5535321", "CSAFPID-5535322", "CSAFPID-5535323", "CSAFPID-5535324", "CSAFPID-5535325", "CSAFPID-5535327", "CSAFPID-5535328", "CSAFPID-5535329", "CSAFPID-5535330", "CSAFPID-5535331", "CSAFPID-5535332", "CSAFPID-5535333", "CSAFPID-5535334", "CSAFPID-5535335", "CSAFPID-5535336", "CSAFPID-5535337", "CSAFPID-5535338", "CSAFPID-5535339", "CSAFPID-5535340", "CSAFPID-5535341", "CSAFPID-5535342", "CSAFPID-5535343", "CSAFPID-5535344", "CSAFPID-5535345", "CSAFPID-5535346", "CSAFPID-5535348", "CSAFPID-5535349", "CSAFPID-5535350", "CSAFPID-5535351", "CSAFPID-5535352", "CSAFPID-5535353", "CSAFPID-5535354", "CSAFPID-5535355", "CSAFPID-5535356", "CSAFPID-5535357", "CSAFPID-5535358", "CSAFPID-5535359", "CSAFPID-5535360", "CSAFPID-5535361", "CSAFPID-5535362", "CSAFPID-5535363", "CSAFPID-5535364", "CSAFPID-5535365", "CSAFPID-5535366", "CSAFPID-5535367", "CSAFPID-5535369", "CSAFPID-5535370", "CSAFPID-5535371", "CSAFPID-5535372", "CSAFPID-5535373", "CSAFPID-5535374", "CSAFPID-5535375", "CSAFPID-5535376", "CSAFPID-5535377", "CSAFPID-5535378", "CSAFPID-5535379", "CSAFPID-5535380", "CSAFPID-5535381", "CSAFPID-5535382", "CSAFPID-5535383", "CSAFPID-5535384", "CSAFPID-5535385", "CSAFPID-5535386", "CSAFPID-5535387", "CSAFPID-5535388", "CSAFPID-5535391", "CSAFPID-5535392", "CSAFPID-5535393", "CSAFPID-5535394", "CSAFPID-5535395", "CSAFPID-5535396", "CSAFPID-5535397", "CSAFPID-5535398", "CSAFPID-5535399", "CSAFPID-5535400", "CSAFPID-5535401", "CSAFPID-5535402", "CSAFPID-5535403", "CSAFPID-5535404", "CSAFPID-5535405", "CSAFPID-5535406", "CSAFPID-5535407", "CSAFPID-5535408", "CSAFPID-5535409", "CSAFPID-5535410", "CSAFPID-5535412", "CSAFPID-5535413", "CSAFPID-5535414", "CSAFPID-5535415", "CSAFPID-5535416", "CSAFPID-5535417", "CSAFPID-5535418", "CSAFPID-5535419", "CSAFPID-5535420", "CSAFPID-5535421", "CSAFPID-5535422", "CSAFPID-5535423", "CSAFPID-5535424", "CSAFPID-5535425", "CSAFPID-5535426", "CSAFPID-5535427", "CSAFPID-5535428", "CSAFPID-5535429", "CSAFPID-5535430", "CSAFPID-5535431", "CSAFPID-5535433", "CSAFPID-5535434", "CSAFPID-5535435", "CSAFPID-5535436", "CSAFPID-5535437", "CSAFPID-5535438", "CSAFPID-5535439", "CSAFPID-5535440", "CSAFPID-5535441", "CSAFPID-5535442", "CSAFPID-5535443", "CSAFPID-5535444", "CSAFPID-5535445", "CSAFPID-5535446", "CSAFPID-5535447", "CSAFPID-5535448", "CSAFPID-5535449", "CSAFPID-5535450", "CSAFPID-5535451", "CSAFPID-5535452", "CSAFPID-5813206", "CSAFPID-5813207", "CSAFPID-5813208", "CSAFPID-5813209", "CSAFPID-5813210", "CSAFPID-5813211", "CSAFPID-5813212", "CSAFPID-5813213", "CSAFPID-5813214", "CSAFPID-5813215", "CSAFPID-5813216", "CSAFPID-5813217", "CSAFPID-5813218", "CSAFPID-5813219", "CSAFPID-5813220", "CSAFPID-5813221", "CSAFPID-5813222", "CSAFPID-5813223", "CSAFPID-5813224", "CSAFPID-5813225", "CSAFPID-5813226", "CSAFPID-5813227", "CSAFPID-5813228", "CSAFPID-5813229", "CSAFPID-5813230", "CSAFPID-5813231", "CSAFPID-5813232", "CSAFPID-5813233", "CSAFPID-5813234", "CSAFPID-5813235", "CSAFPID-5813236", "CSAFPID-5813237", "CSAFPID-5813238", "CSAFPID-5813239", "CSAFPID-5813240", "CSAFPID-5813241", "CSAFPID-5813242", "CSAFPID-5813243", "CSAFPID-5813244", "CSAFPID-5813245", "CSAFPID-5813246", "CSAFPID-5813247", "CSAFPID-5813248", "CSAFPID-5813249", "CSAFPID-5813250", "CSAFPID-5813251", "CSAFPID-5813252", "CSAFPID-5813253", "CSAFPID-5813254", "CSAFPID-5813255", "CSAFPID-5813256", "CSAFPID-5813257", "CSAFPID-5813258", "CSAFPID-5813259", "CSAFPID-5813260", "CSAFPID-5813261", "CSAFPID-5813262", "CSAFPID-5813263", "CSAFPID-5813264", "CSAFPID-5813265", "CSAFPID-5813266", "CSAFPID-5813267", "CSAFPID-5813268", "CSAFPID-5813269", "CSAFPID-5813270", "CSAFPID-5813271", "CSAFPID-5813272", "CSAFPID-5813273", "CSAFPID-5813274", "CSAFPID-5813275", "CSAFPID-5813276", "CSAFPID-5813277", "CSAFPID-5813278", "CSAFPID-5813279", "CSAFPID-5813280", "CSAFPID-5813281", "CSAFPID-5813282", "CSAFPID-5813283", "CSAFPID-5813284", "CSAFPID-5813285", "CSAFPID-5813286", "CSAFPID-5813287", "CSAFPID-5813288", "CSAFPID-5813289", "CSAFPID-5813290", "CSAFPID-5813291", "CSAFPID-5813292", "CSAFPID-5813293", "CSAFPID-5813294", "CSAFPID-5813295", "CSAFPID-5813296", "CSAFPID-5813297", "CSAFPID-5813298", "CSAFPID-5813299", "CSAFPID-5813300", "CSAFPID-5813301", "CSAFPID-5813302", "CSAFPID-5813303", "CSAFPID-5813304", "CSAFPID-5813305", "CSAFPID-5813306", "CSAFPID-5813307", "CSAFPID-5813308", "CSAFPID-5813309", "CSAFPID-5813310", "CSAFPID-5813311", "CSAFPID-5813312", "CSAFPID-5813313", "CSAFPID-5813314", "CSAFPID-5813315", "CSAFPID-5813316", "CSAFPID-5813317", "CSAFPID-5813318", "CSAFPID-5813319", "CSAFPID-5813320", "CSAFPID-5813321", "CSAFPID-5813322", "CSAFPID-5813323", "CSAFPID-5813324", "CSAFPID-5813325", "CSAFPID-5813326", "CSAFPID-5813327", "CSAFPID-5813328", "CSAFPID-5813329", "CSAFPID-5813330", "CSAFPID-5813331", "CSAFPID-5813332", "CSAFPID-5813333", "CSAFPID-5813334", "CSAFPID-5813335", "CSAFPID-5813336", "CSAFPID-5813337", "CSAFPID-5813338", "CSAFPID-5813339", "CSAFPID-5813340", "CSAFPID-5813341", "CSAFPID-5813342", "CSAFPID-5813343", "CSAFPID-5813344", "CSAFPID-5813345", "CSAFPID-5813346", "CSAFPID-5813347", "CSAFPID-5813348", "CSAFPID-5813349", "CSAFPID-5813350", "CSAFPID-5813351", "CSAFPID-5813352", "CSAFPID-5813353", "CSAFPID-5813354", "CSAFPID-5813355", "CSAFPID-5813356", "CSAFPID-5813357", "CSAFPID-5813358", "CSAFPID-5813359", "CSAFPID-5813360", "CSAFPID-5813361", "CSAFPID-5813362", "CSAFPID-5813363", "CSAFPID-5813364", "CSAFPID-5813365", "CSAFPID-5813366", "CSAFPID-5813367", "CSAFPID-5813368", "CSAFPID-5813369", "CSAFPID-5813370", "CSAFPID-5813371", "CSAFPID-5813372", "CSAFPID-5813373", "CSAFPID-5827451", "CSAFPID-5827452", "CSAFPID-5827453", "CSAFPID-5827454", "CSAFPID-5827455", "CSAFPID-5827456", "CSAFPID-5827457", "CSAFPID-5827458", "CSAFPID-5827459", "CSAFPID-5827460", "CSAFPID-5827461", "CSAFPID-5827462", "CSAFPID-5827463", "CSAFPID-5827464", "CSAFPID-5827465", "CSAFPID-5827466", "CSAFPID-5827467", "CSAFPID-5827468", "CSAFPID-5827469", "CSAFPID-5827470", "CSAFPID-5827471", "CSAFPID-5827472", "CSAFPID-5827473", "CSAFPID-5827474", "CSAFPID-5827475", "CSAFPID-5827476", "CSAFPID-5827477", "CSAFPID-5827478", "CSAFPID-5827479", "CSAFPID-5827480", "CSAFPID-5827481", "CSAFPID-5827482", "CSAFPID-5827483", "CSAFPID-5827484", "CSAFPID-5827485", "CSAFPID-5827486", "CSAFPID-5827487", "CSAFPID-5827488", "CSAFPID-5827489", "CSAFPID-5827490", "CSAFPID-5827491", "CSAFPID-5827492", "CSAFPID-5827493", "CSAFPID-5827494", "CSAFPID-5827495", "CSAFPID-5827496", "CSAFPID-5827497", "CSAFPID-5827498", "CSAFPID-5827499", "CSAFPID-5827500", "CSAFPID-5827501", "CSAFPID-5827502", "CSAFPID-5827503", "CSAFPID-5827504", "CSAFPID-5827505", "CSAFPID-5827506", "CSAFPID-5827507", "CSAFPID-5827508", "CSAFPID-5827509", "CSAFPID-5827510", "CSAFPID-5827511", "CSAFPID-5827512", "CSAFPID-5827513", "CSAFPID-5827514", "CSAFPID-5827515", "CSAFPID-5827516", "CSAFPID-5827517", "CSAFPID-5827518", "CSAFPID-5827519", "CSAFPID-5827520", "CSAFPID-5827521", "CSAFPID-5827522", "CSAFPID-5827523", "CSAFPID-5827524", "CSAFPID-5827525", "CSAFPID-5827526", "CSAFPID-5827527", "CSAFPID-5827528", "CSAFPID-5827529", "CSAFPID-5827530", "CSAFPID-5827531", "CSAFPID-5827532", "CSAFPID-5827533", "CSAFPID-1330300", "CSAFPID-5984833", "CSAFPID-5984834", "CSAFPID-5984835" ], "known_not_affected": [ "CSAFPID-1459359", "CSAFPID-1780157" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26130" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26130.json" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Mar" }, { "category": "external", "summary": "Source - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26130" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-26130" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0085" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0657.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26130" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-26130" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26130.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4456" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4456.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4454" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4454.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4443" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4443.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/NuGet%2FGHSA-4vgm-c2wm-63mw.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4450" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4450.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4453" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4453.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4451" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4451.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4455" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4455.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4458" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4458.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4445" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:4445.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Ubuntu%2FUSN-8085-1.json?alt=media" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26130.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-26130" }, { "category": "external", "summary": "News - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0657.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0657" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://msrc.microsoft.com/update-guide/" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://github.com/dotnet/aspnetcore/security/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26130" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26130" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-4vgm-c2wm-63mw" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4443" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4450" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-26130" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446134" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4456" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446098" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4456.json" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4454" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4454.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4443.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4454.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4453.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4445.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://linux.oracle.com/errata/ELSA-2026-4455.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://linux.oracle.com/errata/ELSA-2026-4458.html" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4445" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4451.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4450.html" }, { "category": "external", "summary": "Reference - certbundde; osv", "url": "https://ubuntu.com/security/notices/USN-8085-1" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4450.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4453" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4453.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4451" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4451.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4455" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4455.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:4458" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4458.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4445.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://ubuntu.com/security/CVE-2026-26127" }, { "category": "external", "summary": "Reference - osv", "url": "https://ubuntu.com/security/CVE-2026-26130" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://linux.oracle.com/errata/ELSA-2026-4456.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4443" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4458" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4455" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4456" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4454" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4453" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4451" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4450" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://errata.build.resf.org/RLSA-2026:4445" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-4443.html" } ], "remediations": [ { "category": "vendor_fix", "details": "5081277", "product_ids": [ "CSAFPID-2467377" ], "url": "https://dotnet.microsoft.com/en-us/download/dotnet/8.0" }, { "category": "vendor_fix", "details": "5081278", "product_ids": [ "CSAFPID-2467378" ], "url": "https://dotnet.microsoft.com/en-us/download/dotnet/9.0" }, { "category": "vendor_fix", "details": "5081276", "product_ids": [ "CSAFPID-5774218" ], "url": "https://dotnet.microsoft.com/download/dotnet/10.0" }, { "category": "mitigation", "details": "To mitigate this issue, configure resource limits and throttling for ASP.NET Core applications. This can be achieved by implementing request limits within the application configuration or by utilizing resource quotas provided by container orchestration platforms like OpenShift/Kubernetes. Additionally, web servers acting as reverse proxies can be configured to rate limit incoming requests.\nExample for OpenShift/Kubernetes ResourceQuotas:\n```yaml\napiVersion: v1\nkind: ResourceQuota\nmetadata:\nname: aspnet-core-quotas\nspec:\nhard:\nrequests.cpu: \"1\"\nrequests.memory: \"1Gi\"\nlimits.cpu: \"2\"\nlimits.memory: \"2Gi\"\n```\nConsult ASP.NET Core documentation for application-level request throttling configurations. Ensure that any changes to resource limits or throttling are thoroughly tested to avoid unintended service disruptions. A service restart or reload may be required for changes to take effect.", "product_ids": [ "CSAFPID-1439317", "CSAFPID-1439319", "CSAFPID-1459359", "CSAFPID-1780157", "CSAFPID-5183811", "CSAFPID-5811171", "CSAFPID-5811173", "CSAFPID-5811175", "CSAFPID-5811178", "CSAFPID-5811180", "CSAFPID-5811182", "CSAFPID-5811184", "CSAFPID-5811186", "CSAFPID-5811188" ] }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432758", "CSAFPID-2837107", "CSAFPID-5811516", "CSAFPID-5811517", "CSAFPID-5811518", "CSAFPID-5811519", "CSAFPID-5811520", "CSAFPID-5811521", "CSAFPID-5811522", "CSAFPID-5811523", "CSAFPID-5811524", "CSAFPID-5811525", "CSAFPID-5811526", "CSAFPID-5811527", "CSAFPID-5811528", "CSAFPID-5811529", "CSAFPID-5811530", "CSAFPID-5811531", "CSAFPID-5811532", "CSAFPID-5811533", "CSAFPID-5811534", "CSAFPID-5811535", "CSAFPID-5811536", "CSAFPID-5811537" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4456" }, { "category": "workaround", "details": "To mitigate this issue, configure resource limits and throttling for ASP.NET Core applications. This can be achieved by implementing request limits within the application configuration or by utilizing resource quotas provided by container orchestration platforms like OpenShift/Kubernetes. Additionally, web servers acting as reverse proxies can be configured to rate limit incoming requests.\n\nExample for OpenShift/Kubernetes ResourceQuotas:\n```yaml\napiVersion: v1\nkind: ResourceQuota\nmetadata:\n name: aspnet-core-quotas\nspec:\n hard:\n requests.cpu: \"1\"\n requests.memory: \"1Gi\"\n limits.cpu: \"2\"\n limits.memory: \"2Gi\"\n```\n\nConsult ASP.NET Core documentation for application-level request throttling configurations. Ensure that any changes to resource limits or throttling are thoroughly tested to avoid unintended service disruptions. A service restart or reload may be required for changes to take effect.", "product_ids": [ "CSAFPID-1432758", "CSAFPID-2837107", "CSAFPID-5811516", "CSAFPID-5811517", "CSAFPID-5811518", "CSAFPID-5811519", "CSAFPID-5811520", "CSAFPID-5811521", "CSAFPID-5811522", "CSAFPID-5811523", "CSAFPID-5811524", "CSAFPID-5811525", "CSAFPID-5811526", "CSAFPID-5811527", "CSAFPID-5811528", "CSAFPID-5811529", "CSAFPID-5811530", "CSAFPID-5811531", "CSAFPID-5811532", "CSAFPID-5811533", "CSAFPID-5811534", "CSAFPID-5811535", "CSAFPID-5811536", "CSAFPID-5811537", "CSAFPID-5811576", "CSAFPID-5811577", "CSAFPID-5811578", "CSAFPID-5811579", "CSAFPID-5811580", "CSAFPID-5811581", "CSAFPID-5811582", "CSAFPID-5811583", "CSAFPID-5811584", "CSAFPID-5811585", "CSAFPID-5811586", "CSAFPID-5811587", "CSAFPID-5811588", "CSAFPID-5811589", "CSAFPID-5811590", "CSAFPID-5811591", "CSAFPID-5811592", "CSAFPID-5811593", "CSAFPID-5811594", "CSAFPID-1432908", "CSAFPID-1437608", "CSAFPID-5811660", "CSAFPID-5811661", "CSAFPID-5811662", "CSAFPID-5811663", "CSAFPID-5811664", "CSAFPID-5811665", "CSAFPID-5811666", "CSAFPID-5811667", "CSAFPID-5811668", "CSAFPID-5811669", "CSAFPID-5811670", "CSAFPID-5811671", "CSAFPID-5811672", "CSAFPID-5811673", "CSAFPID-5811674", "CSAFPID-5811675", "CSAFPID-5811676", "CSAFPID-5811677", "CSAFPID-5811678", "CSAFPID-5811679", "CSAFPID-5811680", "CSAFPID-5811681", "CSAFPID-5180271", "CSAFPID-5180289", "CSAFPID-5813838", "CSAFPID-5813839", "CSAFPID-5813840", "CSAFPID-5813841", "CSAFPID-5813842", "CSAFPID-5813843", "CSAFPID-5813844", "CSAFPID-5813845", "CSAFPID-5813846", "CSAFPID-5813847", "CSAFPID-5813848", "CSAFPID-5813849", "CSAFPID-5813850", "CSAFPID-5813851", "CSAFPID-5813852", "CSAFPID-5813853", "CSAFPID-5813854", "CSAFPID-5813855", "CSAFPID-5813856", "CSAFPID-5813857", "CSAFPID-5813858", "CSAFPID-5813859", "CSAFPID-5813860", "CSAFPID-5813861", "CSAFPID-5813862", "CSAFPID-5813863", "CSAFPID-5813864", "CSAFPID-5813865", "CSAFPID-5813866", "CSAFPID-5813867", "CSAFPID-5813868", "CSAFPID-5813869", "CSAFPID-5813870", "CSAFPID-5813871", "CSAFPID-5813872", "CSAFPID-5813873", "CSAFPID-5813874", "CSAFPID-5813875", "CSAFPID-5813876", "CSAFPID-5813877", "CSAFPID-5813878", "CSAFPID-5813879", "CSAFPID-5813880", "CSAFPID-5813909", "CSAFPID-5813910", "CSAFPID-5813911", "CSAFPID-5813912", "CSAFPID-5813913", "CSAFPID-5813914", "CSAFPID-5813915", "CSAFPID-5813916", "CSAFPID-5813917", "CSAFPID-5813918", "CSAFPID-5813919", "CSAFPID-5813920", "CSAFPID-5813921", "CSAFPID-5813922", "CSAFPID-5813923", "CSAFPID-5813924", "CSAFPID-5813925", "CSAFPID-5813926", "CSAFPID-5813943", "CSAFPID-5813944", "CSAFPID-5813945", "CSAFPID-5813946", "CSAFPID-5813947", "CSAFPID-5813948", "CSAFPID-5813949", "CSAFPID-5813950", "CSAFPID-5813951", "CSAFPID-5813952", "CSAFPID-5813953", "CSAFPID-5813954", "CSAFPID-5813955", "CSAFPID-5813956", "CSAFPID-5813957", "CSAFPID-5813958", "CSAFPID-5813959", "CSAFPID-5813960", "CSAFPID-5813961", "CSAFPID-5813968", "CSAFPID-5813969", "CSAFPID-5813970", "CSAFPID-5813971", "CSAFPID-5813972", "CSAFPID-5813973", "CSAFPID-5813974", "CSAFPID-5813975", "CSAFPID-5813976", "CSAFPID-5813977", "CSAFPID-5813978", "CSAFPID-5813979", "CSAFPID-5813980", "CSAFPID-5813981", "CSAFPID-5813982", "CSAFPID-5813983", "CSAFPID-5813984", "CSAFPID-5813985", "CSAFPID-5813986", "CSAFPID-5813987", "CSAFPID-5813988", "CSAFPID-5813989", "CSAFPID-5813990", "CSAFPID-5813991", "CSAFPID-5814507", "CSAFPID-5814508", "CSAFPID-5814509", "CSAFPID-5814510", "CSAFPID-5814511", "CSAFPID-5814512", "CSAFPID-5814513", "CSAFPID-5814514", "CSAFPID-5814515", "CSAFPID-5814516", "CSAFPID-5814517", "CSAFPID-5814518", "CSAFPID-5814519", "CSAFPID-5814520", "CSAFPID-5814521", "CSAFPID-5814522", "CSAFPID-5814523", "CSAFPID-5814524", "CSAFPID-5814525", "CSAFPID-5814526", "CSAFPID-5814527", "CSAFPID-5814528", "CSAFPID-5814529" ] }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432758", "CSAFPID-2837107", "CSAFPID-5811576", "CSAFPID-5811577", "CSAFPID-5811578", "CSAFPID-5811579", "CSAFPID-5811580", "CSAFPID-5811581", "CSAFPID-5811582", "CSAFPID-5811583", "CSAFPID-5811584", "CSAFPID-5811585", "CSAFPID-5811586", "CSAFPID-5811587", "CSAFPID-5811588", "CSAFPID-5811589", "CSAFPID-5811590", "CSAFPID-5811591", "CSAFPID-5811592", "CSAFPID-5811593", "CSAFPID-5811594" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4454" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432908", "CSAFPID-1437608", "CSAFPID-5811660", "CSAFPID-5811661", "CSAFPID-5811662", "CSAFPID-5811663", "CSAFPID-5811664", "CSAFPID-5811665", "CSAFPID-5811666", "CSAFPID-5811667", "CSAFPID-5811668", "CSAFPID-5811669", "CSAFPID-5811670", "CSAFPID-5811671", "CSAFPID-5811672", "CSAFPID-5811673", "CSAFPID-5811674", "CSAFPID-5811675", "CSAFPID-5811676", "CSAFPID-5811677", "CSAFPID-5811678", "CSAFPID-5811679", "CSAFPID-5811680", "CSAFPID-5811681" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4443" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-5180271", "CSAFPID-5180289", "CSAFPID-5813838", "CSAFPID-5813839", "CSAFPID-5813840", "CSAFPID-5813841", "CSAFPID-5813842", "CSAFPID-5813843", "CSAFPID-5813844", "CSAFPID-5813845", "CSAFPID-5813846", "CSAFPID-5813847", "CSAFPID-5813848", "CSAFPID-5813849", "CSAFPID-5813850", "CSAFPID-5813851", "CSAFPID-5813852", "CSAFPID-5813853", "CSAFPID-5813854", "CSAFPID-5813855", "CSAFPID-5813856", "CSAFPID-5813857", "CSAFPID-5813858" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4450" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-5180271", "CSAFPID-5180289", "CSAFPID-5813859", "CSAFPID-5813860", "CSAFPID-5813861", "CSAFPID-5813862", "CSAFPID-5813863", "CSAFPID-5813864", "CSAFPID-5813865", "CSAFPID-5813866", "CSAFPID-5813867", "CSAFPID-5813868", "CSAFPID-5813869", "CSAFPID-5813870", "CSAFPID-5813871", "CSAFPID-5813872", "CSAFPID-5813873", "CSAFPID-5813874", "CSAFPID-5813875", "CSAFPID-5813876", "CSAFPID-5813877", "CSAFPID-5813878", "CSAFPID-5813879", "CSAFPID-5813880" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4453" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-5180271", "CSAFPID-5180289", "CSAFPID-5813909", "CSAFPID-5813910", "CSAFPID-5813911", "CSAFPID-5813912", "CSAFPID-5813913", "CSAFPID-5813914", "CSAFPID-5813915", "CSAFPID-5813916", "CSAFPID-5813917", "CSAFPID-5813918", "CSAFPID-5813919", "CSAFPID-5813920", "CSAFPID-5813921", "CSAFPID-5813922", "CSAFPID-5813923", "CSAFPID-5813924", "CSAFPID-5813925", "CSAFPID-5813926" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4451" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432908", "CSAFPID-1437608", "CSAFPID-5813943", "CSAFPID-5813944", "CSAFPID-5813945", "CSAFPID-5813946", "CSAFPID-5813947", "CSAFPID-5813948", "CSAFPID-5813949", "CSAFPID-5813950", "CSAFPID-5813951", "CSAFPID-5813952", "CSAFPID-5813953", "CSAFPID-5813954", "CSAFPID-5813955", "CSAFPID-5813956", "CSAFPID-5813957", "CSAFPID-5813958", "CSAFPID-5813959", "CSAFPID-5813960", "CSAFPID-5813961" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4455" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432908", "CSAFPID-1437608", "CSAFPID-5813968", "CSAFPID-5813969", "CSAFPID-5813970", "CSAFPID-5813971", "CSAFPID-5813972", "CSAFPID-5813973", "CSAFPID-5813974", "CSAFPID-5813975", "CSAFPID-5813976", "CSAFPID-5813977", "CSAFPID-5813978", "CSAFPID-5813979", "CSAFPID-5813980", "CSAFPID-5813981", "CSAFPID-5813982", "CSAFPID-5813983", "CSAFPID-5813984", "CSAFPID-5813985", "CSAFPID-5813986", "CSAFPID-5813987", "CSAFPID-5813988", "CSAFPID-5813989", "CSAFPID-5813990", "CSAFPID-5813991" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4458" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-1432758", "CSAFPID-2837107", "CSAFPID-5814507", "CSAFPID-5814508", "CSAFPID-5814509", "CSAFPID-5814510", "CSAFPID-5814511", "CSAFPID-5814512", "CSAFPID-5814513", "CSAFPID-5814514", "CSAFPID-5814515", "CSAFPID-5814516", "CSAFPID-5814517", "CSAFPID-5814518", "CSAFPID-5814519", "CSAFPID-5814520", "CSAFPID-5814521", "CSAFPID-5814522", "CSAFPID-5814523", "CSAFPID-5814524", "CSAFPID-5814525", "CSAFPID-5814526", "CSAFPID-5814527", "CSAFPID-5814528", "CSAFPID-5814529" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:4445" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1317175", "CSAFPID-1317177", "CSAFPID-1330299", "CSAFPID-1330300", "CSAFPID-1439317", "CSAFPID-1439319", "CSAFPID-2467377", "CSAFPID-2467378", "CSAFPID-2470409", "CSAFPID-2470410", "CSAFPID-5183811", "CSAFPID-5535100", "CSAFPID-5535101", "CSAFPID-5535102", "CSAFPID-5535103", "CSAFPID-5535104", "CSAFPID-5535105", "CSAFPID-5535106", "CSAFPID-5535107", "CSAFPID-5535108", "CSAFPID-5535109", "CSAFPID-5535111", "CSAFPID-5535112", "CSAFPID-5535113", "CSAFPID-5535114", "CSAFPID-5535115", "CSAFPID-5535116", "CSAFPID-5535117", "CSAFPID-5535118", "CSAFPID-5535119", "CSAFPID-5535120", "CSAFPID-5535122", "CSAFPID-5535123", "CSAFPID-5535124", "CSAFPID-5535125", "CSAFPID-5535126", "CSAFPID-5535127", "CSAFPID-5535128", "CSAFPID-5535129", "CSAFPID-5535130", "CSAFPID-5535131", "CSAFPID-5535133", "CSAFPID-5535134", "CSAFPID-5535135", "CSAFPID-5535136", "CSAFPID-5535137", "CSAFPID-5535138", "CSAFPID-5535139", "CSAFPID-5535140", "CSAFPID-5535141", "CSAFPID-5535142", "CSAFPID-5535144", "CSAFPID-5535145", "CSAFPID-5535146", "CSAFPID-5535147", "CSAFPID-5535148", "CSAFPID-5535149", "CSAFPID-5535150", "CSAFPID-5535151", "CSAFPID-5535152", "CSAFPID-5535153", "CSAFPID-5535155", "CSAFPID-5535156", "CSAFPID-5535157", "CSAFPID-5535158", "CSAFPID-5535159", "CSAFPID-5535160", "CSAFPID-5535161", "CSAFPID-5535162", "CSAFPID-5535163", "CSAFPID-5535164", "CSAFPID-5535166", "CSAFPID-5535167", "CSAFPID-5535168", "CSAFPID-5535169", "CSAFPID-5535170", "CSAFPID-5535171", "CSAFPID-5535172", "CSAFPID-5535173", "CSAFPID-5535174", "CSAFPID-5535175", "CSAFPID-5535177", "CSAFPID-5535178", "CSAFPID-5535179", "CSAFPID-5535180", "CSAFPID-5535181", "CSAFPID-5535182", "CSAFPID-5535183", "CSAFPID-5535184", "CSAFPID-5535185", "CSAFPID-5535186", "CSAFPID-5535189", "CSAFPID-5535190", "CSAFPID-5535191", "CSAFPID-5535192", "CSAFPID-5535193", "CSAFPID-5535194", "CSAFPID-5535195", "CSAFPID-5535196", "CSAFPID-5535197", "CSAFPID-5535198", "CSAFPID-5535200", "CSAFPID-5535201", "CSAFPID-5535202", "CSAFPID-5535203", "CSAFPID-5535204", "CSAFPID-5535205", "CSAFPID-5535206", "CSAFPID-5535207", "CSAFPID-5535208", "CSAFPID-5535209", "CSAFPID-5535211", "CSAFPID-5535212", "CSAFPID-5535213", "CSAFPID-5535214", "CSAFPID-5535215", "CSAFPID-5535216", "CSAFPID-5535217", "CSAFPID-5535218", "CSAFPID-5535219", "CSAFPID-5535220", "CSAFPID-5535222", "CSAFPID-5535223", "CSAFPID-5535224", "CSAFPID-5535225", "CSAFPID-5535226", "CSAFPID-5535227", "CSAFPID-5535228", "CSAFPID-5535229", "CSAFPID-5535230", "CSAFPID-5535231", "CSAFPID-5535232", "CSAFPID-5535233", "CSAFPID-5535234", "CSAFPID-5535235", "CSAFPID-5535236", "CSAFPID-5535237", "CSAFPID-5535238", "CSAFPID-5535239", "CSAFPID-5535240", "CSAFPID-5535241", "CSAFPID-5535243", "CSAFPID-5535244", "CSAFPID-5535245", "CSAFPID-5535246", "CSAFPID-5535247", "CSAFPID-5535248", "CSAFPID-5535249", "CSAFPID-5535250", "CSAFPID-5535251", "CSAFPID-5535252", "CSAFPID-5535253", "CSAFPID-5535254", "CSAFPID-5535255", "CSAFPID-5535256", "CSAFPID-5535257", "CSAFPID-5535258", "CSAFPID-5535259", "CSAFPID-5535260", "CSAFPID-5535261", "CSAFPID-5535262", "CSAFPID-5535264", "CSAFPID-5535265", "CSAFPID-5535266", "CSAFPID-5535267", "CSAFPID-5535268", "CSAFPID-5535269", "CSAFPID-5535270", "CSAFPID-5535271", "CSAFPID-5535272", "CSAFPID-5535273", "CSAFPID-5535274", "CSAFPID-5535275", "CSAFPID-5535276", "CSAFPID-5535277", "CSAFPID-5535278", "CSAFPID-5535279", "CSAFPID-5535280", "CSAFPID-5535281", "CSAFPID-5535282", "CSAFPID-5535283", "CSAFPID-5535285", "CSAFPID-5535286", "CSAFPID-5535287", "CSAFPID-5535288", "CSAFPID-5535289", "CSAFPID-5535290", "CSAFPID-5535291", "CSAFPID-5535292", "CSAFPID-5535293", "CSAFPID-5535294", "CSAFPID-5535295", "CSAFPID-5535296", "CSAFPID-5535297", "CSAFPID-5535298", "CSAFPID-5535299", "CSAFPID-5535300", "CSAFPID-5535301", "CSAFPID-5535302", "CSAFPID-5535303", "CSAFPID-5535304", "CSAFPID-5535306", "CSAFPID-5535307", "CSAFPID-5535308", "CSAFPID-5535309", "CSAFPID-5535310", "CSAFPID-5535311", "CSAFPID-5535312", "CSAFPID-5535313", "CSAFPID-5535314", "CSAFPID-5535315", "CSAFPID-5535316", "CSAFPID-5535317", "CSAFPID-5535318", "CSAFPID-5535319", "CSAFPID-5535320", "CSAFPID-5535321", "CSAFPID-5535322", "CSAFPID-5535323", "CSAFPID-5535324", "CSAFPID-5535325", "CSAFPID-5535327", "CSAFPID-5535328", "CSAFPID-5535329", "CSAFPID-5535330", "CSAFPID-5535331", "CSAFPID-5535332", "CSAFPID-5535333", "CSAFPID-5535334", "CSAFPID-5535335", "CSAFPID-5535336", "CSAFPID-5535337", "CSAFPID-5535338", "CSAFPID-5535339", "CSAFPID-5535340", "CSAFPID-5535341", "CSAFPID-5535342", "CSAFPID-5535343", "CSAFPID-5535344", "CSAFPID-5535345", "CSAFPID-5535346", "CSAFPID-5535348", "CSAFPID-5535349", "CSAFPID-5535350", "CSAFPID-5535351", "CSAFPID-5535352", "CSAFPID-5535353", "CSAFPID-5535354", "CSAFPID-5535355", "CSAFPID-5535356", "CSAFPID-5535357", "CSAFPID-5535358", "CSAFPID-5535359", "CSAFPID-5535360", "CSAFPID-5535361", "CSAFPID-5535362", "CSAFPID-5535363", "CSAFPID-5535364", "CSAFPID-5535365", "CSAFPID-5535366", "CSAFPID-5535367", "CSAFPID-5535369", "CSAFPID-5535370", "CSAFPID-5535371", "CSAFPID-5535372", "CSAFPID-5535373", "CSAFPID-5535374", "CSAFPID-5535375", "CSAFPID-5535376", "CSAFPID-5535377", "CSAFPID-5535378", "CSAFPID-5535379", "CSAFPID-5535380", "CSAFPID-5535381", "CSAFPID-5535382", "CSAFPID-5535383", "CSAFPID-5535384", "CSAFPID-5535385", "CSAFPID-5535386", "CSAFPID-5535387", "CSAFPID-5535388", "CSAFPID-5535391", "CSAFPID-5535392", "CSAFPID-5535393", "CSAFPID-5535394", "CSAFPID-5535395", "CSAFPID-5535396", "CSAFPID-5535397", "CSAFPID-5535398", "CSAFPID-5535399", "CSAFPID-5535400", "CSAFPID-5535401", "CSAFPID-5535402", "CSAFPID-5535403", "CSAFPID-5535404", "CSAFPID-5535405", "CSAFPID-5535406", "CSAFPID-5535407", "CSAFPID-5535408", "CSAFPID-5535409", "CSAFPID-5535410", "CSAFPID-5535412", "CSAFPID-5535413", "CSAFPID-5535414", "CSAFPID-5535415", "CSAFPID-5535416", "CSAFPID-5535417", "CSAFPID-5535418", "CSAFPID-5535419", "CSAFPID-5535420", "CSAFPID-5535421", "CSAFPID-5535422", "CSAFPID-5535423", "CSAFPID-5535424", "CSAFPID-5535425", "CSAFPID-5535426", "CSAFPID-5535427", "CSAFPID-5535428", "CSAFPID-5535429", "CSAFPID-5535430", "CSAFPID-5535431", "CSAFPID-5535433", "CSAFPID-5535434", "CSAFPID-5535435", "CSAFPID-5535436", "CSAFPID-5535437", "CSAFPID-5535438", "CSAFPID-5535439", "CSAFPID-5535440", "CSAFPID-5535441", "CSAFPID-5535442", "CSAFPID-5535443", "CSAFPID-5535444", "CSAFPID-5535445", "CSAFPID-5535446", "CSAFPID-5535447", "CSAFPID-5535448", "CSAFPID-5535449", "CSAFPID-5535450", "CSAFPID-5535451", "CSAFPID-5535452", "CSAFPID-5774218", "CSAFPID-5775348", "CSAFPID-5775349", "CSAFPID-5775350", "CSAFPID-5793557", "CSAFPID-5810232", "CSAFPID-5810233", "CSAFPID-5811171", "CSAFPID-5811173", "CSAFPID-5811175", "CSAFPID-5811178", "CSAFPID-5811180", "CSAFPID-5811182", "CSAFPID-5811184", "CSAFPID-5811186", "CSAFPID-5811188", "CSAFPID-5813206", "CSAFPID-5813207", "CSAFPID-5813208", "CSAFPID-5813209", "CSAFPID-5813210", "CSAFPID-5813211", "CSAFPID-5813212", "CSAFPID-5813213", "CSAFPID-5813214", "CSAFPID-5813215", "CSAFPID-5813216", "CSAFPID-5813217", "CSAFPID-5813218", "CSAFPID-5813219", "CSAFPID-5813220", "CSAFPID-5813221", "CSAFPID-5813222", "CSAFPID-5813223", "CSAFPID-5813224", "CSAFPID-5813225", "CSAFPID-5813226", "CSAFPID-5813227", "CSAFPID-5813228", "CSAFPID-5813229", "CSAFPID-5813230", "CSAFPID-5813231", "CSAFPID-5813232", "CSAFPID-5813233", "CSAFPID-5813234", "CSAFPID-5813235", "CSAFPID-5813236", "CSAFPID-5813237", "CSAFPID-5813238", "CSAFPID-5813239", "CSAFPID-5813240", "CSAFPID-5813241", "CSAFPID-5813242", "CSAFPID-5813243", "CSAFPID-5813244", "CSAFPID-5813245", "CSAFPID-5813246", "CSAFPID-5813247", "CSAFPID-5813248", "CSAFPID-5813249", "CSAFPID-5813250", "CSAFPID-5813251", "CSAFPID-5813252", "CSAFPID-5813253", "CSAFPID-5813254", "CSAFPID-5813255", "CSAFPID-5813256", "CSAFPID-5813257", "CSAFPID-5813258", "CSAFPID-5813259", "CSAFPID-5813260", "CSAFPID-5813261", "CSAFPID-5813262", "CSAFPID-5813263", "CSAFPID-5813264", "CSAFPID-5813265", "CSAFPID-5813266", "CSAFPID-5813267", "CSAFPID-5813268", "CSAFPID-5813269", "CSAFPID-5813270", "CSAFPID-5813271", "CSAFPID-5813272", "CSAFPID-5813273", "CSAFPID-5813274", "CSAFPID-5813275", "CSAFPID-5813276", "CSAFPID-5813277", "CSAFPID-5813278", "CSAFPID-5813279", "CSAFPID-5813280", "CSAFPID-5813281", "CSAFPID-5813282", "CSAFPID-5813283", "CSAFPID-5813284", "CSAFPID-5813285", "CSAFPID-5813286", "CSAFPID-5813287", "CSAFPID-5813288", "CSAFPID-5813289", "CSAFPID-5813290", "CSAFPID-5813291", "CSAFPID-5813292", "CSAFPID-5813293", "CSAFPID-5813294", "CSAFPID-5813295", "CSAFPID-5813296", "CSAFPID-5813297", "CSAFPID-5813298", "CSAFPID-5813299", "CSAFPID-5813300", "CSAFPID-5813301", "CSAFPID-5813302", "CSAFPID-5813303", "CSAFPID-5813304", "CSAFPID-5813305", "CSAFPID-5813306", "CSAFPID-5813307", "CSAFPID-5813308", "CSAFPID-5813309", "CSAFPID-5813310", "CSAFPID-5813311", "CSAFPID-5813312", "CSAFPID-5813313", "CSAFPID-5813314", "CSAFPID-5813315", "CSAFPID-5813316", "CSAFPID-5813317", "CSAFPID-5813318", "CSAFPID-5813319", "CSAFPID-5813320", "CSAFPID-5813321", "CSAFPID-5813322", "CSAFPID-5813323", "CSAFPID-5813324", "CSAFPID-5813325", "CSAFPID-5813326", "CSAFPID-5813327", "CSAFPID-5813328", "CSAFPID-5813329", "CSAFPID-5813330", "CSAFPID-5813331", "CSAFPID-5813332", "CSAFPID-5813333", "CSAFPID-5813334", "CSAFPID-5813335", "CSAFPID-5813336", "CSAFPID-5813337", "CSAFPID-5813338", "CSAFPID-5813339", "CSAFPID-5813340", "CSAFPID-5813341", "CSAFPID-5813342", "CSAFPID-5813343", "CSAFPID-5813344", "CSAFPID-5813345", "CSAFPID-5813346", "CSAFPID-5813347", "CSAFPID-5813348", "CSAFPID-5813349", "CSAFPID-5813350", "CSAFPID-5813351", "CSAFPID-5813352", "CSAFPID-5813353", "CSAFPID-5813354", "CSAFPID-5813355", "CSAFPID-5813356", "CSAFPID-5813357", "CSAFPID-5813358", "CSAFPID-5813359", "CSAFPID-5813360", "CSAFPID-5813361", "CSAFPID-5813362", "CSAFPID-5813363", "CSAFPID-5813364", "CSAFPID-5813365", "CSAFPID-5813366", "CSAFPID-5813367", "CSAFPID-5813368", "CSAFPID-5813369", "CSAFPID-5813370", "CSAFPID-5813371", "CSAFPID-5813372", "CSAFPID-5813373", "CSAFPID-5827451", "CSAFPID-5827452", "CSAFPID-5827453", "CSAFPID-5827454", "CSAFPID-5827455", "CSAFPID-5827456", "CSAFPID-5827457", "CSAFPID-5827458", "CSAFPID-5827459", "CSAFPID-5827460", "CSAFPID-5827461", "CSAFPID-5827462", "CSAFPID-5827463", "CSAFPID-5827464", "CSAFPID-5827465", "CSAFPID-5827466", "CSAFPID-5827467", "CSAFPID-5827468", "CSAFPID-5827469", "CSAFPID-5827470", "CSAFPID-5827471", "CSAFPID-5827472", "CSAFPID-5827473", "CSAFPID-5827474", "CSAFPID-5827475", "CSAFPID-5827476", "CSAFPID-5827477", "CSAFPID-5827478", "CSAFPID-5827479", "CSAFPID-5827480", "CSAFPID-5827481", "CSAFPID-5827482", "CSAFPID-5827483", "CSAFPID-5827484", "CSAFPID-5827485", "CSAFPID-5827486", "CSAFPID-5827487", "CSAFPID-5827488", "CSAFPID-5827489", "CSAFPID-5827490", "CSAFPID-5827491", "CSAFPID-5827492", "CSAFPID-5827493", "CSAFPID-5827494", "CSAFPID-5827495", "CSAFPID-5827496", "CSAFPID-5827497", "CSAFPID-5827498", "CSAFPID-5827499", "CSAFPID-5827500", "CSAFPID-5827501", "CSAFPID-5827502", "CSAFPID-5827503", "CSAFPID-5827504", "CSAFPID-5827505", "CSAFPID-5827506", "CSAFPID-5827507", "CSAFPID-5827508", "CSAFPID-5827509", "CSAFPID-5827510", "CSAFPID-5827511", "CSAFPID-5827512", "CSAFPID-5827513", "CSAFPID-5827514", "CSAFPID-5827515", "CSAFPID-5827516", "CSAFPID-5827517", "CSAFPID-5827518", "CSAFPID-5827519", "CSAFPID-5827520", "CSAFPID-5827521", "CSAFPID-5827522", "CSAFPID-5827523", "CSAFPID-5827524", "CSAFPID-5827525", "CSAFPID-5827526", "CSAFPID-5827527", "CSAFPID-5827528", "CSAFPID-5827529", "CSAFPID-5827530", "CSAFPID-5827531", "CSAFPID-5827532", "CSAFPID-5827533", "CSAFPID-5984833", "CSAFPID-5984834", "CSAFPID-5984835" ] } ], "threats": [ { "category": "exploit_status", "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely", "product_ids": [ "CSAFPID-2467377", "CSAFPID-2467378", "CSAFPID-5774218" ] }, { "category": "impact", "details": "Denial of Service", "product_ids": [ "CSAFPID-2467377", "CSAFPID-2467378", "CSAFPID-5774218" ] }, { "category": "exploit_status", "details": "exploited" } ], "title": "CVE-2026-26130" } ] }