https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 00:11:28 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118747 <p>Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.</p> <p>Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118747 https://db.gcve.eu/vuln/ghsa-vmv3-wvjp-wqpj <p><strong>Affected:</strong> NuGet: System.Formats.Cbor</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.</p> <p>Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/501</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-407</p> <p>## Affected Platforms</p> <p>- **Platforms:** Any supported OS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The tables list affected package versions and fixed versions. These are independently versioned NuGet packages, not runtime patch versions.</p> <p>### 8.0 - standalone packages</p> <p>Package | Affected version | Patched version --- | --- | --- [System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | &gt;= 8.0.0-0, &lt; 8.0.2 | 8.0.2</p> <p>### 9.0 - standalone packages</p> <p>Package | Affected version | Patched version --- | --- | --- [System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | &gt;= 9.0.0-0, &lt; 9.0.24 | 9.0.24</p> <p>Update 9.0 applications to System.Formats.Cbor 9.0.24; 9.0.23 is not a fix. The fixed 10.0.15 package, which includes a net9.0 target, remains an alternative.</p> <p>### 10.0 - standalone packages</p> <p>Package | Affected version | Patc…</p> <p><strong>Affected:</strong> NuGet: System.Formats.Cbor</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.</p> <p>Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/501</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-407</p> <p>## Affected Platforms</p> <p>- **Platforms:** Any supported OS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The tables list affected package versions and fixed versions. These are independently versioned NuGet packages, not runtime patch versions.</p> <p>### 8.0 - standalone packages</p> <p>Package | Affected version | Patched version --- | --- | --- [System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | &gt;= 8.0.0-0, &lt; 8.0.2 | 8.0.2</p> <p>### 9.0 - standalone packages</p> <p>Package | Affected version | Patched version --- | --- | --- [System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | &gt;= 9.0.0-0, &lt; 9.0.24 | 9.0.24</p> <p>Update 9.0 applications to System.Formats.Cbor 9.0.24; 9.0.23 is not a fix. The fixed 10.0.15 package, which includes a net9.0 target, remains an alternative.</p> <p>### 10.0 - standalone packages</p> <p>Package | Affected version | Patc…</p> https://db.gcve.eu/vuln/ghsa-vmv3-wvjp-wqpj https://db.gcve.eu/vuln/ncsc-2026-0473 NCSC-2026-0473 https://db.gcve.eu/vuln/ncsc-2026-0473