.NET Core Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.
Patches
-
If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
-
If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
-
If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.
Other Details
- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/194
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/57175
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26423
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-arm | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-arm64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.linux-x64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.linux-arm | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.linux-arm64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.linux-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.Mono.osx-x64 | >= 5.0.0, < 5.0.9 | 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.osx-x64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.rhel.6-x64 | >= 3.1.0, < 3.1.18 | 3.1.18 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.win-arm | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.win-arm64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.win-x64 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
| .NET (NuGet) | Microsoft.NETCore.App.Runtime.win-x86 | >= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9 | 3.1.18, 5.0.9 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
-- Platform
- .NET (NuGet)
- Package
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm- Disclosed
- 25.10.2022
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rh58-r7jh-xhx3 - CC BY 4.0
Vulnerability history: Microsoft.NETCore.App.Runtime.linux-x64
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 36
- First → latest
- 09.2020 10.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- High 22
- Medium 13
- Low 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 6
- 2023: 5
- 2024: 4
- 2025: 5
- 2026: 15
-
.NET Core Elevation of Privilege Vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.