High

.NET Core Elevation of Privilege Vulnerability

Disclosed: 25.10.2022
Updated: 11.10.2026 11:23

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.

Patches

If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.

Other Details

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/194
An Issue for this can be found at https://github.com/dotnet/runtime/issues/57175
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26423

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-arm	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-arm64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.linux-x64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.linux-arm	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.linux-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.Mono.osx-x64	>= 5.0.0, < 5.0.9	5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.osx-x64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.rhel.6-x64	>= 3.1.0, < 3.1.18	3.1.18
.NET (NuGet)	Microsoft.NETCore.App.Runtime.win-arm	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.win-arm64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.win-x64	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9
.NET (NuGet)	Microsoft.NETCore.App.Runtime.win-x86	>= 3.1.0, < 3.1.18, >= 5.0.0, < 5.0.9	3.1.18, 5.0.9

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): -
Platform: .NET (NuGet)
Package: Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm
Disclosed: 25.10.2022
Updated: 11.10.2026 11:23

Sources and licenses

OSV / GitHub Advisory Database - GHSA-rh58-r7jh-xhx3 - CC BY 4.0

Vulnerability history: Microsoft.NETCore.App.Runtime.Mono.linux-arm

All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 5
First → latest: 09.2020 10.2022
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 1
Medium 4

Disclosures per year

2020: 1
2021: 0
2022: 4
2023: 0
2024: 0
2025: 0
2026: 0

25.10.2022

.NET Core Elevation of Privilege Vulnerability this entry

High · 7.5 CVE-2021-26423 >= 5.0.0, < 5.0.9 5.0.9
20.10.2022

.NET Core Information Disclosure Vulnerability

Medium · 5.5 CVE-2021-34485 >= 5.0.0, < 5.0.9 5.0.9
18.10.2022

.NET Remote Code Execution Vulnerability

Medium · 6.3 CVE-2022-24512 >= 5.0.0, < 5.0.15, >= 6.0.0, < 6.0.3 5.0.15, 6.0.3
24.05.2022

Denial of service in .NET core

Medium · 6.5 CVE-2021-1721 >= 5.0.0, < 5.0.3 5.0.3
15.09.2020

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happe

Medium · 6.5 CVE-2020-36846 >= 5.0.0, < 5.0.15, >= 6.0.0, < 6.0.3 5.0.15, 6.0.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application