Common Weakness Enumeration

CWE-787

Weakness Allowed-with-Review

Out-of-bounds Write

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product writes data past the end, or before the beginning, of the intended buffer.

Dimensions

  • Behavior-Type: Write
  • Resource-Type: Memory Buffer
  • Resource-Property: Out-of-bounds
Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities. However, closer examination is required.

While this CWE is allowed for mapping, it has more specific children that might be a better fit. Carefully read both the name and description to ensure that this mapping is appropriate. Consider the root cause errors that have led to the out-of-bounds write by examining "CanFollow" relationships for this entry.

Relationships and members
ChildOf: CWE-119 · View CWE-1000
ChildOf: CWE-119 · View CWE-1003
ChildOf: CWE-119 · View CWE-1305
ChildOf: CWE-119 · View CWE-1340
Modes of introduction
Implementation
Detection methods

Automated Static Analysis

This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.

Automated static analysis generally does not account for environmental considerations when reporting out-of-bounds memory operations. This can make it difficult for users to determine which warnings should be investigated first. For example, an analysis tool might report buffer overflows that originate from command line arguments in a program that is not expected to run with setuid or other special privileges.

Effectiveness: High

Detection techniques for buffer-related errors are more mature than for most other weakness types.

Automated Dynamic Analysis

This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Effectiveness: Moderate

Crafted inputs are necessary to reach the code containing the error, such as generated by fuzzers. Also, these tools may reduce performance, and they only report the error condition - not the original mistake that led to the error.

Content history
Submission: CWE Content Team · MITRE · 2009-10-21 · CWE 1.6
Contribution: "Mapping CWE to 62443" Sub-Working Group · CWE-CAPEC ICS/OT SIG · 2023-04-25 · CWE 4.11

Suggested mappings to ISA/IEC 62443.

Contribution: Abhi Balakrishnan · 2024-02-29 · CWE 4.15

Provided diagram to improve CWE usability

Modification: CWE Content Team · MITRE · 2010-02-16 · CWE 1.8

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2010-09-27 · CWE 1.10

updated Relationships

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2015-12-07 · CWE 2.9

updated Relationships

Modification: CWE Content Team · MITRE · 2018-03-27 · CWE 3.1

updated Description

Modification: CWE Content Team · MITRE · 2019-09-19 · CWE 3.4

updated Applicable_Platforms, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Potential_Mitigations, References, Relationships, Time_of_Introduction

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Alternate_Terms, Demonstrative_Examples, Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Relationships

Modification: CWE Content Team · MITRE · 2021-03-15 · CWE 4.4

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Demonstrative_Examples, Potential_Mitigations, Relationships

Modification: CWE Content Team · MITRE · 2022-06-28 · CWE 4.8

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Alternate_Terms, Demonstrative_Examples, Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Potential_Mitigations, References, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2024-02-29 · CWE 4.14

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2024-07-16 · CWE 4.15

updated Alternate_Terms, Common_Consequences, Description, Diagram, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2024-11-19 · CWE 4.16

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Affected_Resources, Functional_Areas, References

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Detection_Factors, References, Relationships

Modification: CWE Content Team · MITRE · 2026-04-30 · CWE 4.20

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings

16909 vulnerabilities reference this CWE, most recent first.

GHSA-P39G-X9XH-7WQ9

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation.

A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax.

Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64277"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:08Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf \u0026 RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core\u0027s default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.",
  "id": "GHSA-p39g-x9xh-7wq9",
  "modified": "2026-07-27T06:30:31Z",
  "published": "2026-07-25T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64277"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3F7-94HF-7GVM

Vulnerability from github – Published: 2022-08-26 00:03 – Updated: 2022-08-28 00:00
VLAI
Details

H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-36498"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-25T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed.",
  "id": "GHSA-p3f7-94hf-7gvm",
  "modified": "2022-08-28T00:00:30Z",
  "published": "2022-08-26T00:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36498"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/H3C%20NX18%20Plus/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3FG-CHRP-P7MQ

Vulnerability from github – Published: 2024-11-28 00:39 – Updated: 2024-11-28 00:39
VLAI
Details

Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24504.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11794"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-28T00:15:04Z",
    "severity": "HIGH"
  },
  "details": "Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24504.",
  "id": "GHSA-p3fg-chrp-p7mq",
  "modified": "2024-11-28T00:39:27Z",
  "published": "2024-11-28T00:39:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11794"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1620"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3G4-4PHF-G392

Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2023-09-29 15:30
VLAI
Details

A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-3246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-20T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.",
  "id": "GHSA-p3g4-4phf-g392",
  "modified": "2023-09-29T15:30:25Z",
  "published": "2022-05-24T19:08:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3246"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libsndfile/libsndfile/issues/687"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUDCEMMPRA3IYYYHVZUOUZXI65FU37V"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7LNW4AVDVL3BU3N3KGVFLTYFASBVCIF"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202309-11"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4947"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3GC-PJGJ-G65J

Vulnerability from github – Published: 2022-05-14 01:21 – Updated: 2025-04-20 03:33
VLAI
Details

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-6307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-24T04:59:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.",
  "id": "GHSA-p3gc-pjgj-g65j",
  "modified": "2025-04-20T03:33:21Z",
  "published": "2022-05-14T01:21:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verdammelt/tnef/commit/1a17af1ed0c791aec44dbdc9eab91218cc1e335a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verdammelt/tnef/blob/master/ChangeLog"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201708-02"
    },
    {
      "type": "WEB",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2017-004-tnef"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2017/dsa-3798"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/96427"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3GR-8H6R-849H

Vulnerability from github – Published: 2022-05-14 03:41 – Updated: 2022-05-14 03:41
VLAI
Details

Huawei AR120-S V200R006C10, V200R007C00, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C02, AR1200-S V200R006C10, V200R007C00, V200R008C20, AR150 V200R006C10, V200R007C00, V200R007C02, AR150-S V200R006C10, V200R007C00, AR160 V200R006C10, V200R006C12, V200R007C00, V200R007C02, AR200 V200R006C10, V200R007C00, AR200-S V200R006C10, V200R007C00, AR2200 V200R006C10, V200R006C13, V200R006C16PWE, V200R007C00, V200R007C02, AR2200-S V200R006C10, V200R007C00, V200R008C20, AR3200 V200R006C10, V200R006C11, V200R007C00, V200R007C02, AR3600 V200R006C10, V200R007C00, AR510 V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, NetEngine16EX V200R006C10, V200R007C00, SRG1300 V200R006C10, V200R007C00, V200R007C02, SRG2300 V200R006C10, V200R007C00, V200R007C02, SRG3300 V200R006C10, V200R007C00 have a buffer overflow vulnerability due to incomplete range checks of the input data. An unauthenticated, remote attacker could exploit this vulnerability by sending malicious IKE packets to the targeted device. An exploit could allow the attacker to cause the device to write out of bound and restart.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-17160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-15T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Huawei AR120-S V200R006C10, V200R007C00, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C02, AR1200-S V200R006C10, V200R007C00, V200R008C20, AR150 V200R006C10, V200R007C00, V200R007C02, AR150-S V200R006C10, V200R007C00, AR160 V200R006C10, V200R006C12, V200R007C00, V200R007C02, AR200 V200R006C10, V200R007C00, AR200-S V200R006C10, V200R007C00, AR2200 V200R006C10, V200R006C13, V200R006C16PWE, V200R007C00, V200R007C02, AR2200-S V200R006C10, V200R007C00, V200R008C20, AR3200 V200R006C10, V200R006C11, V200R007C00, V200R007C02, AR3600 V200R006C10, V200R007C00, AR510 V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, NetEngine16EX V200R006C10, V200R007C00, SRG1300 V200R006C10, V200R007C00, V200R007C02, SRG2300 V200R006C10, V200R007C00, V200R007C02, SRG3300 V200R006C10, V200R007C00 have a buffer overflow vulnerability due to incomplete range checks of the input data. An unauthenticated, remote attacker could exploit this vulnerability by sending malicious IKE packets to the targeted device. An exploit could allow the attacker to cause the device to write out of bound and restart.",
  "id": "GHSA-p3gr-8h6r-849h",
  "modified": "2022-05-14T03:41:10Z",
  "published": "2022-05-14T03:41:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17160"
    },
    {
      "type": "WEB",
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171213-01-ike-en"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3GV-G2H9-4GH2

Vulnerability from github – Published: 2026-09-09 06:31 – Updated: 2026-09-23 21:30
VLAI
Details

Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-21107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T05:17:23Z",
    "severity": "MODERATE"
  },
  "details": "Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.",
  "id": "GHSA-p3gv-g2h9-4gh2",
  "modified": "2026-09-23T21:30:26Z",
  "published": "2026-09-09T06:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21107"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2026\u0026month=09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P3GX-MHHH-V7WR

Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-09-23 21:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC

Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IO_TLB_SEGSIZE, but the free list is initialized with the assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE. As a result, swiotlb_area_find_slots() may allocate slots past the end of a transient IO TLB buffer.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-52790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T16:15:17Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC\n\nLimit the free list length to the size of the IO TLB. Transient pool can be\nsmaller than IO_TLB_SEGSIZE, but the free list is initialized with the\nassumption that the total number of slots is a multiple of IO_TLB_SEGSIZE.\nAs a result, swiotlb_area_find_slots() may allocate slots past the end of\na transient IO TLB buffer.",
  "id": "GHSA-p3gx-mhhh-v7wr",
  "modified": "2025-09-23T21:30:53Z",
  "published": "2024-05-21T18:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52790"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/53c87e846e335e3c18044c397cc35178163d7827"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce7612496a4ba6068bc68aa1fa9d947dadb4ad9b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3JM-9QCF-M97R

Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30
VLAI
Details

D-Link DAP-2622 DDP Set SSID List PSK Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20101.

Severity
8.8 (High)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-37323"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T02:15:42Z",
    "severity": "HIGH"
  },
  "details": "D-Link DAP-2622 DDP Set SSID List PSK Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20101.",
  "id": "GHSA-p3jm-9qcf-m97r",
  "modified": "2024-05-03T03:30:53Z",
  "published": "2024-05-03T03:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37323"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1277"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P3JP-9V83-76W9

Vulnerability from github – Published: 2026-11-03 17:33 – Updated: 2026-11-03 17:33
VLAI
Summary
Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
Details

Executive summary

A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/494

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 8.1
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
  • Weakness: CWE-787 (Out-of-bounds Write)

Affected Platforms

  • Platforms: All
  • Architectures: All

Mitigations

ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:

Until the update can be deployed, avoid decompressing attacker-controlled Brotli data.

The following examples show how to disable Brotli decompression if you are already using it.

Warning: Do not use these code snippets if you are not already using decompression. Do not introduce a call to AddRequestDecompression if your application does not already call it. Similarly, do not introduce an AutomaticDecompression property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.

If you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the br entry from your existing decompression configuration. This retains the default gzip and deflate providers:

builder.Services.AddRequestDecompression(options =>
{
    options.DecompressionProviders.Remove("br");
});

If your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include DecompressionMethods.Brotli:

var handler = new HttpClientHandler
{
    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
};

var httpClient = new HttpClient(handler);

Applications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.

Affected Packages

The vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.

.NET 8

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.win-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.win-x86 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-x86 >= 8.0.0, < 8.0.33 8.0.33

.NET 9

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.osx-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.osx-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-x86 >= 9.0.0, < 9.0.22 9.0.22

.NET 10

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.osx-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.osx-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-x86 >= 10.0.0, < 10.0.14 10.0.14

.NET 11 previews

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.ios-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.iossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.iossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.maccatalyst-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.maccatalyst-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.osx-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.osx-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvos-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-x86 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148

Advisory FAQ

How do I know if I am affected?

You are affected if your application uses an affected Brotli decoder included in a package listed in affected packages, including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See mitigations for the affected usage paths and default settings.

How do I fix the issue?

Install the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.

.NET release Runtime SDK versions
.NET 8 8.0.33 8.0.133, 8.0.427
.NET 9 9.0.22 9.0.123, 9.0.320
.NET 10 10.0.14 10.0.114, 10.0.403
.NET 11 previews 11.0.0-rc.3.26522.148 11.0.100-rc.3.26522.148

Download .NET from https://dotnet.microsoft.com/download/dotnet.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

If you have deployed self-contained applications, rebuild and redeploy those applications with the updated runtime.

For NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine's shared runtime alone does not replace a decoder already linked into a NativeAOT executable.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-111497

Revisions

V1.0 (10/25/2026): Initial advisory.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T17:33:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Executive summary\n\nA buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.\n\nASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/494\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.1\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Mitigations\n\nASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:\n\n- Enable ASP.NET Core [automatic request decompression](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression) with Brotli (`br`) support.\n- Enable HttpClient automatic response decompression by configuring [HttpClientHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression) or [SocketsHttpHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression) to include [DecompressionMethods.Brotli](https://learn.microsoft.com/dotnet/api/system.net.decompressionmethods) or `DecompressionMethods.All`.\n- Explicitly use Brotli decompression APIs in `System.IO.Compression`, such as `BrotliStream` or `BrotliDecoder`.\n\nUntil the update can be deployed, avoid decompressing attacker-controlled Brotli data.\n\nThe following examples show how to disable Brotli decompression if you are already using it.\n\n\u003e **Warning: Do not use these code snippets if you are not already using decompression.** Do not introduce a call to `AddRequestDecompression` if your application does not already call it. Similarly, do not introduce an `AutomaticDecompression` property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.\n\nIf you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the `br` entry from your existing decompression configuration. This retains the default gzip and deflate providers:\n\n```csharp\nbuilder.Services.AddRequestDecompression(options =\u003e\n{\n    options.DecompressionProviders.Remove(\"br\");\n});\n```\n\nIf your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include `DecompressionMethods.Brotli`:\n\n```csharp\nvar handler = new HttpClientHandler\n{\n    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate\n};\n\nvar httpClient = new HttpClient(handler);\n```\n\nApplications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\n\nThe vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.\n\n### .NET 8\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n\n### .NET 9\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n\n### .NET 10\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n\n### .NET 11 previews\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.ios-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvos-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nYou are affected if your application uses an affected Brotli decoder included in a package listed in [affected packages](#affected-packages), including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See [mitigations](#mitigations) for the affected usage paths and default settings.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\nInstall the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.\n\n.NET release | Runtime | SDK versions\n------------ | ------- | ------------\n.NET 8 | 8.0.33 | 8.0.133, 8.0.427\n.NET 9 | 9.0.22 | 9.0.123, 9.0.320\n.NET 10 | 10.0.14 | 10.0.114, 10.0.403\n.NET 11 previews | 11.0.0-rc.3.26522.148 | 11.0.100-rc.3.26522.148\n\nDownload .NET from https://dotnet.microsoft.com/download/dotnet.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nIf you have deployed [self-contained applications](https://learn.microsoft.com/dotnet/core/deploying/#self-contained-deployments), rebuild and redeploy those applications with the updated runtime.\n\nFor NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine\u0027s shared runtime alone does not replace a decoder already linked into a NativeAOT executable.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497)\n\n### Revisions\n\nV1.0 (10/25/2026): Initial advisory.",
  "id": "GHSA-p3jp-9v83-76w9",
  "modified": "2026-11-03T17:33:51Z",
  "published": "2026-11-03T17:33:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/issues/136446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/pull/136471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/commit/f3d8b2f230bc7c9899df6eef2d41e2748107cffa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/runtime"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability"
}
Mitigation MIT-3
Requirements

Strategy: Language Selection

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
  • Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
  • Consider adhering to the following rules when allocating and managing an application's memory:
  • Double check that the buffer is as large as specified.
  • When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
  • Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
  • If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation

Strategy: Environment Hardening

  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
  • For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation

Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list