Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Microsoft.AspNetCore.App.Runtime.win-x64

28 known vulnerabilities (2 critical, 20 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
10.0.14 (Oct 25, 2026): no advisory affects it
Newest unaffected release
10.0.14 (Oct 25, 2026), the latest release
Advisories
28 · 2 critical, 20 high, 2 medium
Releases
256 since 3.0.0 (Sep 23, 2019)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-88092
    Affects 8.0.0 to 8.0.31 (8.0.32 is outside it); 9.0.0 to 9.0.20 (9.0.21 is outside it); 10.0.0 to 10.0.12 (10.0.13 is outside it); 11.0.0-preview.1.26104.118 to 11.0.0-rc.1.26425.128 (11.0.0-rc.2.26504.105 is outside it)
  • CVE-2026-56170
    Affects 8.0.0 to 8.0.25 (8.0.26 is outside it); 9.0.0 to 9.0.14 (9.0.15 is outside it); 10.0.0 to 10.0.5 (10.0.6 is outside it)
  • CVE-2026-45591
    Affects 8.0.0 to 8.0.27 (8.0.28 is outside it); 9.0.0 to 9.0.16 (9.0.17 is outside it); 10.0.0 to 10.0.8 (10.0.9 is outside it)
  • CVE-2026-42899
    Affects 8.0.0 to 8.0.26 (8.0.27 is outside it); 9.0.0 to 9.0.15 (9.0.16 is outside it); 10.0.0 to 10.0.7 (10.0.8 is outside it)
  • CVE-2026-26130
    Affects 8.0.0 to 8.0.24 (8.0.25 is outside it); 9.0.0 to 9.0.13 (9.0.14 is outside it); 10.0.0 to 10.0.3 (10.0.4 is outside it)
  • CVE-2025-55315
    Affects 8.0.0 to 8.0.20 (8.0.21 is outside it); 9.0.0 to 9.0.9 (9.0.10 is outside it); 10.0.0-rc.1.25451.107 (10.0.0-rc.2.25502.107 is outside it)
  • CVE-2025-24070
    Affects 6.0.0 to 6.0.36 (7.0.0-preview.1.22109.13 is outside it); 8.0.0 to 8.0.13 (8.0.14 is outside it); 9.0.0 to 9.0.2 (9.0.3 is outside it)
  • CVE-2024-38229
    Affects 8.0.0 to 8.0.8 (8.0.10 is outside it); 9.0.0-preview.1.24081.5 to 9.0.0-rc.1.24452.1 (9.0.0-rc.2.24474.3 is outside it)
  • CVE-2024-38168
    Affects 8.0.0 to 8.0.7 (8.0.8 is outside it)
  • CVE-2024-35264
    Affects 8.0.0 to 8.0.6 (8.0.7 is outside it)
  • CVE-2024-30046
    Affects 7.0.0 to 7.0.18 (7.0.19 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it)
  • CVE-2024-21386
    Affects 3.0.0-preview4-19216-03 to 6.0.26 (6.0.27 is outside it); 7.0.0 to 7.0.15 (7.0.16 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
Show all 28 advisoriesShow fewer advisories
  • CVE-2023-38180
    Affects 6.0.0 to 6.0.20 (6.0.21 is outside it); 7.0.0 to 7.0.9 (7.0.10 is outside it)
  • CVE-2023-38178
    Affects 7.0.0 to 7.0.9 (7.0.10 is outside it)
  • CVE-2023-33170
    Affects 3.0.0-preview4-19216-03 to 6.0.19 (6.0.20 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it)
  • CVE-2022-38013
    Affects 3.1.0 to 3.1.28 (3.1.29 is outside it); 5.0.0 to 6.0.8 (6.0.9 is outside it)
  • CVE-2022-34716
    Affects 3.1.0 to 3.1.27 (3.1.28 is outside it); 6.0.0 to 6.0.7 (6.0.8 is outside it)
  • CVE-2022-29145
    Affects 3.0.0 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it)
  • CVE-2022-29117
    Affects 3.0.0 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it)
  • CVE-2022-23267
    Affects 3.0.0 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it)
  • CVE-2022-24464
    Affects 3.0.0 to 3.1.22 (3.1.23 is outside it); 5.0.0 to 5.0.14 (5.0.15 is outside it); 6.0.0 to 6.0.2 (6.0.3 is outside it)
  • CVE-2022-21986
    Affects 5.0.0 to 5.0.13 (5.0.14 is outside it); 6.0.0 to 6.0.1 (6.0.2 is outside it)
  • CVE-2021-1723
    Affects 3.1.0 to 3.1.10 (3.1.11 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it)
  • CVE-2020-1045
    Affects 3.1.0 to 3.1.7 (3.1.8 is outside it)
  • CVE-2020-1597
    Affects 3.1.0 to 3.1.6 (3.1.7 is outside it)
  • CVE-2020-1161
    Affects 3.1.0 to 3.1.3 (3.1.4 is outside it)
  • CVE-2020-0603
    Affects 3.1.0 (3.1.1 is outside it)
  • CVE-2020-0602
    Affects 3.1.0 (3.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 28

  • CVE-2026-88092Critical 9.4

    ASP.NET Core Tampering Vulnerability

    Affected: from 8.0.0, fixed in 8.0.32; from 10.0.0, fixed in 10.0.13; from 11.0.0-preview.1, fixed in 11.0.0-rc.2; from 9.0.0, fixed in 9.0.21.

    Fixed in 8.0.32 (released Oct 13, 2026, the day of disclosure), 9.0.21 (released Oct 13, 2026, the day of disclosure) and 10.0.13 (released Oct 13, 2026, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 10.0.0, fixed in 10.0.6; from 9.0.0, fixed in 9.0.15; from 8.0.0, fixed in 8.0.26.

    Fixed in 8.0.26 (released Apr 14, 2026, 91 days before disclosure), 9.0.15 (released Apr 14, 2026, 91 days before disclosure) and 10.0.6 (released Apr 14, 2026, 91 days before disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 8.0.0, fixed in 8.0.28; from 9.0.0, fixed in 9.0.17; from 10.0.0, fixed in 10.0.9.

    Fixed in 8.0.28 (released Jun 9, 2026, the day of disclosure), 9.0.17 (released Jun 9, 2026, the day of disclosure) and 10.0.9 (released Jun 9, 2026, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 8.0.0, fixed in 8.0.27; from 9.0.0, fixed in 9.0.16; from 10.0.0, fixed in 10.0.8.

    Fixed in 8.0.27 (released May 12, 2026, the day of disclosure), 9.0.16 (released May 12, 2026, the day of disclosure) and 10.0.8 (released May 12, 2026, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 8.0.0, fixed in 8.0.25; from 9.0.0, fixed in 9.0.14; from 10.0.0, fixed in 10.0.4.

    Fixed in 8.0.25 (released Mar 10, 2026, the day of disclosure), 9.0.14 (released Mar 10, 2026, the day of disclosure) and 10.0.4 (released Mar 10, 2026, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • CVE-2025-55315Critical 9.9

    ASP.NET Security Feature Bypass Vulnerability

    Affected: from 10.0.0-rc.1.25451.107, fixed in 10.0.0-rc.2.25502.107; from 9.0.0, fixed in 9.0.10; from 8.0.0, fixed in 8.0.21.

    Fixed in 8.0.21 (released Oct 14, 2025, the day of disclosure), 9.0.10 (released Oct 14, 2025, the day of disclosure) and 10.0.0-rc.2.25502.107 (released Oct 14, 2025, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

    Affected: from 9.0.0, fixed in 9.0.3; from 8.0.0, fixed in 8.0.14; from 6.0.0, through 6.0.36.

    Fixed in 8.0.14 (released Mar 11, 2025, the day of disclosure) and 9.0.3 (released Mar 11, 2025, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Remote Code Execution Vulnerability

    Affected: from 9.0.0-preview.1.24081.5, fixed in 9.0.0-rc.2.24474.3; from 8.0.0, fixed in 8.0.10.

    Fixed in 8.0.10 (released Oct 8, 2024, the day of disclosure) and 9.0.0-rc.2.24474.3 (released Oct 8, 2024, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 8.0.0, fixed in 8.0.8.

    Fixed in 8.0.8 (released Aug 13, 2024, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Remote Code Execution Vulnerability

    Affected: from 8.0.0, fixed in 8.0.7.

    Fixed in 8.0.7 (released Jul 9, 2024, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • CVE-2024-30046Medium 5.9

    Visual Studio Denial of Service Vulnerability

    Affected: from 7.0.0, fixed in 7.0.19; from 8.0.0, fixed in 8.0.5.

    Fixed in 7.0.19 (released May 14, 2024, the day of disclosure) and 8.0.5 (released May 14, 2024, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET Denial of Service Vulnerability

    Affected: fixed in 6.0.27; from 7.0.0, fixed in 7.0.16; from 8.0.0, fixed in 8.0.2.

    Fixed in 6.0.27 (released Feb 13, 2024, the day of disclosure), 7.0.16 (released Feb 13, 2024, the day of disclosure) and 8.0.2 (released Feb 13, 2024, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • CVE-2023-38180High 7.5 · KEV

    .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 7.0.0, fixed in 7.0.10; from 6.0.0, fixed in 6.0.21.

    Fixed in 6.0.21 (released Aug 8, 2023, the day of disclosure) and 7.0.10 (released Aug 8, 2023, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET Core and Visual Studio Denial of Service Vulnerability

    Affected: from 7.0.0, fixed in 7.0.10.

    Fixed in 7.0.10 (released Aug 8, 2023, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET and Visual Studio Security Feature Bypass Vulnerability

    Affected: fixed in 6.0.20; from 7.0.0, fixed in 7.0.9.

    Fixed in 6.0.20 (released Jul 11, 2023, the day of disclosure) and 7.0.9 (released Jul 11, 2023, the day of disclosure).

    The latest release, 10.0.14, is not affected.

Show all 28 advisoriesShow fewer advisories

  • .NET Core and Visual Studio Denial of Service Vulnerability

    Affected: from 3.1.0, fixed in 3.1.29; from 5.0.0, fixed in 6.0.9.

    Fixed in 3.1.29 (released Sep 13, 2022, the day of disclosure) and 6.0.9 (released Sep 13, 2022, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • CVE-2022-34716Medium 5.9

    .NET Spoofing Vulnerability

    Affected: from 3.1.0, fixed in 3.1.28; from 6.0.0, fixed in 6.0.8.

    Fixed in 3.1.28 (released Aug 9, 2022, the day of disclosure) and 6.0.8 (released Aug 9, 2022, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5.

    Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5.

    Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5.

    Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET and Visual Studio Denial of Service Vulnerability

    Affected: from 3.0.0, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3.

    Fixed in 3.1.23 (released Mar 8, 2022, 1 day before disclosure), 5.0.15 (released Mar 8, 2022, 1 day before disclosure) and 6.0.3 (released Mar 8, 2022, 1 day before disclosure).

    The latest release, 10.0.14, is not affected.

  • .NET Denial of Service Vulnerability

    Affected: from 5.0.0, fixed in 5.0.14; from 6.0.0, fixed in 6.0.2.

    Fixed in 5.0.14 (released Feb 8, 2022, 1 day before disclosure) and 6.0.2 (released Feb 8, 2022, 1 day before disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core and Visual Studio Denial of Service Vulnerability

    Affected: from 3.1.0, fixed in 3.1.11; from 5.0.0, fixed in 5.0.2.

    Fixed in 3.1.11 (released Jan 12, 2021, the day of disclosure) and 5.0.2 (released Jan 12, 2021, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • Microsoft ASP.NET Core Security Feature Bypass Vulnerability

    Affected: from 3.1.0, fixed in 3.1.8.

    Fixed in 3.1.8 (released Sep 8, 2020, 3 days before disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 3.1.0, fixed in 3.1.7.

    Fixed in 3.1.7 (released Aug 11, 2020, 6 days before disclosure).

    The latest release, 10.0.14, is not affected.

  • ASP.NET Core Denial of Service Vulnerability

    Affected: from 3.1.0, fixed in 3.1.4.

    Fixed in 3.1.4 (released May 12, 2020, 9 days before disclosure).

    The latest release, 10.0.14, is not affected.

  • A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who…

    Affected: from 3.1.0, fixed in 3.1.1.

    Fixed in 3.1.1 (released Jan 14, 2020, the day of disclosure).

    The latest release, 10.0.14, is not affected.

  • A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service…

    Affected: from 3.1.0, fixed in 3.1.1.

    Fixed in 3.1.1 (released Jan 14, 2020, the day of disclosure).

    The latest release, 10.0.14, is not affected.