GHSA-P3JP-9V83-76W9

Vulnerability from github – Published: 2026-11-03 17:33 – Updated: 2026-11-03 17:33
VLAI
Summary
Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
Details

Executive summary

A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/494

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 8.1
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
  • Weakness: CWE-787 (Out-of-bounds Write)

Affected Platforms

  • Platforms: All
  • Architectures: All

Mitigations

ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:

Until the update can be deployed, avoid decompressing attacker-controlled Brotli data.

The following examples show how to disable Brotli decompression if you are already using it.

Warning: Do not use these code snippets if you are not already using decompression. Do not introduce a call to AddRequestDecompression if your application does not already call it. Similarly, do not introduce an AutomaticDecompression property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.

If you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the br entry from your existing decompression configuration. This retains the default gzip and deflate providers:

builder.Services.AddRequestDecompression(options =>
{
    options.DecompressionProviders.Remove("br");
});

If your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include DecompressionMethods.Brotli:

var handler = new HttpClientHandler
{
    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
};

var httpClient = new HttpClient(handler);

Applications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.

Affected Packages

The vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.

.NET 8

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.win-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.Mono.win-x86 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.linux-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.osx-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.osx-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-arm64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-x64 >= 8.0.0, < 8.0.33 8.0.33
Microsoft.NETCore.App.Runtime.win-x86 >= 8.0.0, < 8.0.33 8.0.33

.NET 9

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.linux-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.osx-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.osx-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-arm64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-x64 >= 9.0.0, < 9.0.22 9.0.22
Microsoft.NETCore.App.Runtime.win-x86 >= 9.0.0, < 9.0.22 9.0.22

.NET 10

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.android-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.android-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.linux-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.osx-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.osx-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-arm64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-x64 >= 10.0.0, < 10.0.14 10.0.14
Microsoft.NETCore.App.Runtime.win-x86 >= 10.0.0, < 10.0.14 10.0.14

.NET 11 previews

Package name Affected version Patched version
Microsoft.DotNet.ILCompiler >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.android-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.NativeAOT.win-x86 >= 11.0.0-preview.1.26104.118, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.android-x86 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.ios-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.Mono.wasi-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.android-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.browser-wasm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.ios-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.iossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.iossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-bionic-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-bionic-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.linux-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.maccatalyst-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.maccatalyst-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.osx-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.osx-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvos-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvossimulator-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.tvossimulator-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-arm64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-x64 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148
Microsoft.NETCore.App.Runtime.win-x86 >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 11.0.0-rc.3.26522.148

Advisory FAQ

How do I know if I am affected?

You are affected if your application uses an affected Brotli decoder included in a package listed in affected packages, including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See mitigations for the affected usage paths and default settings.

How do I fix the issue?

Install the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.

.NET release Runtime SDK versions
.NET 8 8.0.33 8.0.133, 8.0.427
.NET 9 9.0.22 9.0.123, 9.0.320
.NET 10 10.0.14 10.0.114, 10.0.403
.NET 11 previews 11.0.0-rc.3.26522.148 11.0.100-rc.3.26522.148

Download .NET from https://dotnet.microsoft.com/download/dotnet.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

If you have deployed self-contained applications, rebuild and redeploy those applications with the updated runtime.

For NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine's shared runtime alone does not replace a decoder already linked into a NativeAOT executable.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-111497

Revisions

V1.0 (10/25/2026): Initial advisory.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.DotNet.ILCompiler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1.26104.118"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.android-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.android-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.browser-wasm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.ios-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.iossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.iossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-bionic-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.maccatalyst-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.maccatalyst-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvos-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvossimulator-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.tvossimulator-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.3.26522.148"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T17:33:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Executive summary\n\nA buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.\n\nASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/494\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.1\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## Mitigations\n\nASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths:\n\n- Enable ASP.NET Core [automatic request decompression](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression) with Brotli (`br`) support.\n- Enable HttpClient automatic response decompression by configuring [HttpClientHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression) or [SocketsHttpHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression) to include [DecompressionMethods.Brotli](https://learn.microsoft.com/dotnet/api/system.net.decompressionmethods) or `DecompressionMethods.All`.\n- Explicitly use Brotli decompression APIs in `System.IO.Compression`, such as `BrotliStream` or `BrotliDecoder`.\n\nUntil the update can be deployed, avoid decompressing attacker-controlled Brotli data.\n\nThe following examples show how to disable Brotli decompression if you are already using it.\n\n\u003e **Warning: Do not use these code snippets if you are not already using decompression.** Do not introduce a call to `AddRequestDecompression` if your application does not already call it. Similarly, do not introduce an `AutomaticDecompression` property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.\n\nIf you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the `br` entry from your existing decompression configuration. This retains the default gzip and deflate providers:\n\n```csharp\nbuilder.Services.AddRequestDecompression(options =\u003e\n{\n    options.DecompressionProviders.Remove(\"br\");\n});\n```\n\nIf your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include `DecompressionMethods.Brotli`:\n\n```csharp\nvar handler = new HttpClientHandler\n{\n    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate\n};\n\nvar httpClient = new HttpClient(handler);\n```\n\nApplications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\n\nThe vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.\n\n### .NET 8\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.Mono.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.win-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 8.0.0, \u003c 8.0.33 | 8.0.33\n\n### .NET 9\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 9.0.0, \u003c 9.0.22 | 9.0.22\n\n### .NET 10\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 10.0.0, \u003c 10.0.14 | 10.0.14\n\n### .NET 11 previews\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.DotNet.ILCompiler](https://www.nuget.org/packages/Microsoft.DotNet.ILCompiler) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.android-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x64) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.NativeAOT.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.NativeAOT.win-x86) | \u003e= 11.0.0-preview.1.26104.118, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.android-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.android-x86) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.ios-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvos-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.Mono.wasi-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.Mono.wasi-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.android-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.android-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.browser-wasm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.browser-wasm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.ios-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.ios-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.iossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.iossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-bionic-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-bionic-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.maccatalyst-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.maccatalyst-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvos-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvos-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.tvossimulator-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.tvossimulator-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 11.0.0-preview.1, \u003c 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nYou are affected if your application uses an affected Brotli decoder included in a package listed in [affected packages](#affected-packages), including a decoder linked into a NativeAOT application, to decompress attacker-controlled data. See [mitigations](#mitigations) for the affected usage paths and default settings.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\nInstall the updated runtime or SDK for the .NET version used by your application. If your application directly references an affected package, update that reference to the patched version listed above.\n\n.NET release | Runtime | SDK versions\n------------ | ------- | ------------\n.NET 8 | 8.0.33 | 8.0.133, 8.0.427\n.NET 9 | 9.0.22 | 9.0.123, 9.0.320\n.NET 10 | 10.0.14 | 10.0.114, 10.0.403\n.NET 11 previews | 11.0.0-rc.3.26522.148 | 11.0.100-rc.3.26522.148\n\nDownload .NET from https://dotnet.microsoft.com/download/dotnet.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nIf you have deployed [self-contained applications](https://learn.microsoft.com/dotnet/core/deploying/#self-contained-deployments), rebuild and redeploy those applications with the updated runtime.\n\nFor NativeAOT applications, update the SDK and any explicit compiler or runtime-pack references to patched versions, then republish and redeploy the application. Updating the machine\u0027s shared runtime alone does not replace a decoder already linked into a NativeAOT executable.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497)\n\n### Revisions\n\nV1.0 (10/25/2026): Initial advisory.",
  "id": "GHSA-p3jp-9v83-76w9",
  "modified": "2026-11-03T17:33:51Z",
  "published": "2026-11-03T17:33:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/issues/136446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/pull/136471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/commit/f3d8b2f230bc7c9899df6eef2d41e2748107cffa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/runtime"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.