Known vulnerabilities and malicious package reports for Microsoft.AspNetCore.App.Runtime.win-x64 on NuGet, live from OSV, with CISA KEV exploitation status and EPSS scores.
0 malicious package reports and 35 vulnerabilities returned by OSV. Check a specific version to see which reports apply.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 7.0.0, fixed 7.0.10; introduced 6.0.0, fixed 6.0.21.
Fix versions reported by the advisory: 7.0.10, 6.0.21.
Severity: HIGH.
Known to be exploited (CISA KEV).
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0-rc.1.25451.107, fixed 10.0.0-rc.2.25502.107; introduced 9.0.0, fixed 9.0.10; introduced 8.0.0, fixed 8.0.21.
Fix versions reported by the advisory: 10.0.0-rc.2.25502.107, 9.0.10, 8.0.21.
Severity: CRITICAL.
Remote code execution in ASP.NET Core
Published .
Updated .
Reported affected releases: 3.1.0.
Affected ranges: introduced 3.1.0, fixed 3.1.1.
Fix versions reported by the advisory: 3.1.1.
Severity: HIGH.
Denial of service in ASP.NET Core
Published .
Updated .
Reported affected releases: 3.1.0.
Affected ranges: introduced 3.1.0, fixed 3.1.1.
Fix versions reported by the advisory: 3.1.1.
Severity: HIGH.
ASP.NET Core Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6.
Affected ranges: introduced 3.1.0, fixed 3.1.7.
Fix versions reported by the advisory: 3.1.7.
Severity: HIGH.
Cookie parsing failure
Published .
Updated .
Reported affected releases: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7.
Affected ranges: introduced 3.1.0, fixed 3.1.8.
Fix versions reported by the advisory: 3.1.8.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 3.0.0, fixed 3.1.25; introduced 5.0.0, fixed 5.0.17; introduced 6.0.0, fixed 6.0.5.
Fix versions reported by the advisory: 3.1.25, 5.0.17, 6.0.5.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 3.0.0, fixed 3.1.25; introduced 5.0.0, fixed 5.0.17; introduced 6.0.0, fixed 6.0.5.
Fix versions reported by the advisory: 3.1.25, 5.0.17, 6.0.5.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 3.0.0, fixed 3.1.25; introduced 5.0.0, fixed 5.0.17; introduced 6.0.0, fixed 6.0.5.
Fix versions reported by the advisory: 3.1.25, 5.0.17, 6.0.5.
Severity: HIGH.
ASP.NET Core Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 3.1.0, 3.1.1, 3.1.2, 3.1.3.
Affected ranges: introduced 3.1.0, fixed 3.1.4.
Fix versions reported by the advisory: 3.1.4.
Severity: HIGH.
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 3.1.0, 3.1.1, 3.1.10, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 5.0.0, 5.0.1.
Affected ranges: introduced 3.1.0, fixed 3.1.11; introduced 5.0.0, fixed 5.0.2.
Fix versions reported by the advisory: 3.1.11, 5.0.2.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 3.1.0, fixed 3.1.29; introduced 5.0.0, fixed 6.0.9.
Fix versions reported by the advisory: 3.1.29, 6.0.9.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 5.0.0, 5.0.1, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 6.0.0, 6.0.1.
Affected ranges: introduced 5.0.0, fixed 5.0.14; introduced 6.0.0, fixed 6.0.2.
Fix versions reported by the advisory: 5.0.14, 6.0.2.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 3.0.0, fixed 3.1.23; introduced 5.0.0, fixed 5.0.15; introduced 6.0.0, fixed 6.0.3.
Fix versions reported by the advisory: 3.1.23, 5.0.15, 6.0.3.
Severity: HIGH.
Microsoft Security Advisory CVE-2024-38168 | .NET Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7.
Affected ranges: introduced 8.0.0, fixed 8.0.8.
Fix versions reported by the advisory: 8.0.8.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Reported affected releases: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.7, 7.0.8, 7.0.9.
Affected ranges: introduced 7.0.0, fixed 7.0.10.
Fix versions reported by the advisory: 7.0.10.
Severity: HIGH.
Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability
Published .
Updated .
Reported affected releases: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6.
Affected ranges: introduced 8.0.0, fixed 8.0.7.
Fix versions reported by the advisory: 8.0.7.
Severity: HIGH.
.NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 8.0.0, fixed 8.0.25; introduced 9.0.0, fixed 9.0.14; introduced 10.0.0, fixed 10.0.4.
Fix versions reported by the advisory: 8.0.25, 9.0.14, 10.0.4.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 8.0.0, fixed 8.0.28; introduced 9.0.0, fixed 9.0.17; introduced 10.0.0, fixed 10.0.9.
Fix versions reported by the advisory: 8.0.28, 9.0.17, 10.0.9.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 8.0.0, fixed 8.0.27; introduced 9.0.0, fixed 9.0.16; introduced 10.0.0, fixed 10.0.8.
Fix versions reported by the advisory: 8.0.27, 9.0.16, 10.0.8.
Severity: HIGH.
.NET Information Disclosure Vulnerability
Published .
Updated .
Affected ranges: introduced 3.1.0, fixed 3.1.28; introduced 6.0.0, fixed 6.0.8.
Fix versions reported by the advisory: 3.1.28, 6.0.8.
Severity: MEDIUM.
Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 0, fixed 6.0.27; introduced 7.0.0, fixed 7.0.16; introduced 8.0.0, fixed 8.0.2.
Fix versions reported by the advisory: 6.0.27, 7.0.16, 8.0.2.
Severity: HIGH.
Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability
Published .
Updated .
Reported affected releases: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8.
Affected ranges: introduced 9.0.0-preview.1.24081.5, fixed 9.0.0-rc.2.24474.3; introduced 8.0.0, fixed 8.0.10.
Fix versions reported by the advisory: 9.0.0-rc.2.24474.3, 8.0.10.
Severity: HIGH.
Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability
Published .
Updated .
Affected ranges: introduced 0, fixed 6.0.20; introduced 7.0.0, fixed 7.0.9.
Fix versions reported by the advisory: 6.0.20, 7.0.9.
Severity: HIGH.
Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 7.0.0, fixed 7.0.19; introduced 8.0.0, fixed 8.0.5.
Fix versions reported by the advisory: 7.0.19, 8.0.5.
Severity: MEDIUM.
More reports are available in the interactive package view.
Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.