# Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) vulnerabilities 24 known vulnerabilities (2 critical, 16 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64 ## Advisories (24) ### [CVE-2026-88092](https://cve.now/CVE-2026-88092): ASP.NET Core Tampering Vulnerability - Severity: Critical 9.4 - Published: Oct 13, 2026 - Affected: from 8.0.0, fixed in 8.0.32; from 10.0.0, fixed in 10.0.13; from 11.0.0-preview.1, fixed in 11.0.0-rc.2; from 9.0.0, fixed in 9.0.21. ### [CVE-2026-56170](https://cve.now/CVE-2026-56170): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.6; from 9.0.0, fixed in 9.0.15; from 8.0.0, fixed in 8.0.26. ### [CVE-2026-42899](https://cve.now/CVE-2026-42899): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: May 12, 2026 - Affected: from 8.0.0, fixed in 8.0.27; from 9.0.0, fixed in 9.0.16; from 10.0.0, fixed in 10.0.8. ### [CVE-2026-26130](https://cve.now/CVE-2026-26130): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 10, 2026 - Affected: from 8.0.0, fixed in 8.0.25; from 9.0.0, fixed in 9.0.14; from 10.0.0, fixed in 10.0.4. ### [CVE-2025-55315](https://cve.now/CVE-2025-55315): ASP.NET Security Feature Bypass Vulnerability - Severity: Critical 9.9 - Published: Oct 14, 2025 - Affected: from 10.0.0-rc.1.25451.107, fixed in 10.0.0-rc.2.25502.107; from 9.0.0, fixed in 9.0.10; from 8.0.0, fixed in 8.0.21. ### [CVE-2025-24070](https://cve.now/CVE-2025-24070): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability - Severity: High 7.0 - Published: Mar 11, 2025 - Affected: from 9.0.0, fixed in 9.0.3; from 8.0.0, fixed in 8.0.14; from 6.0.0, through 6.0.36. ### [CVE-2024-38229](https://cve.now/CVE-2024-38229): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 8.1 - Published: Oct 8, 2024 - Affected: from 9.0.0-preview.1.24081.5, fixed in 9.0.0-rc.2.24474.3; from 8.0.0, fixed in 8.0.10. ### [CVE-2024-35264](https://cve.now/CVE-2024-35264): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 8.1 - Published: Jul 9, 2024 - Affected: from 8.0.0, fixed in 8.0.7. ### [CVE-2024-30046](https://cve.now/CVE-2024-30046): Visual Studio Denial of Service Vulnerability - Severity: Medium 5.9 - Published: May 14, 2024 - Affected: from 7.0.0, fixed in 7.0.19; from 8.0.0, fixed in 8.0.5. ### [CVE-2024-21386](https://cve.now/CVE-2024-21386): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Feb 13, 2024 - Affected: fixed in 6.0.27; from 7.0.0, fixed in 7.0.16; from 8.0.0, fixed in 8.0.2. ### [CVE-2023-33170](https://cve.now/CVE-2023-33170): ASP.NET and Visual Studio Security Feature Bypass Vulnerability - Severity: High 8.1 - Published: Jul 11, 2023 - Affected: fixed in 6.0.20; from 7.0.0, fixed in 7.0.9. ### [CVE-2022-38013](https://cve.now/CVE-2022-38013): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Sep 13, 2022 - Affected: from 3.1.0, fixed in 3.1.29; from 5.0.0, fixed in 6.0.9. ### [CVE-2022-34716](https://cve.now/CVE-2022-34716): .NET Spoofing Vulnerability - Severity: Medium 5.9 - Published: Aug 9, 2022 - Affected: from 3.1.0, fixed in 3.1.28; from 6.0.0, fixed in 6.0.8. ### [CVE-2022-29145](https://cve.now/CVE-2022-29145): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. ### [CVE-2022-29117](https://cve.now/CVE-2022-29117): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. ### [CVE-2022-23267](https://cve.now/CVE-2022-23267): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. ### [CVE-2022-24464](https://cve.now/CVE-2022-24464): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 9, 2022 - Affected: from 3.0.0, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3. ### [CVE-2022-21986](https://cve.now/CVE-2022-21986): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Feb 9, 2022 - Affected: from 5.0.0, fixed in 5.0.14; from 6.0.0, fixed in 6.0.2. ### [CVE-2021-1723](https://cve.now/CVE-2021-1723): ASP.NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Jan 12, 2021 - Affected: from 3.1.0, fixed in 3.1.11; from 5.0.0, fixed in 5.0.2. ### [CVE-2020-1045](https://cve.now/CVE-2020-1045): Microsoft ASP.NET Core Security Feature Bypass Vulnerability - Severity: High 7.5 - Published: Sep 11, 2020 - Affected: from 3.1.0, fixed in 3.1.8. ### [CVE-2020-1597](https://cve.now/CVE-2020-1597): ASP.NET Core Denial of Service Vulnerability - Severity: Unrated - Published: Aug 17, 2020 - Affected: from 3.1.0, fixed in 3.1.7. ### [CVE-2020-1161](https://cve.now/CVE-2020-1161): ASP.NET Core Denial of Service Vulnerability - Severity: Unrated - Published: May 21, 2020 - Affected: from 3.1.0, fixed in 3.1.4. ### [CVE-2020-0603](https://cve.now/CVE-2020-0603): A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who… - Severity: Unrated - Published: Jan 14, 2020 - Affected: from 3.1.0, fixed in 3.1.1. ### [CVE-2020-0602](https://cve.now/CVE-2020-0602): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service… - Severity: Unrated - Published: Jan 14, 2020 - Affected: from 3.1.0, fixed in 3.1.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/microsoft.aspnetcore.app.runtime.osx-x64 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.