Sign in
Deutsch English Español Polski
Critical

.NET Core Remote Code Execution Vulnerability

  • Disclosed: 21.04.2021
  • Updated: 11.10.2026 11:23

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name Vulnerable Versions Secure Versions
System.Text.Encodings.Web 4.0.0 - 4.5.0 4.5.1
System.Text.Encodings.Web 4.6.0-4.7.1 4.7.2
System.Text.Encodings.Web 5.0.0 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
.NET (NuGet) System.Text.Encodings.Web >= 4.0.0, < 4.5.1, >= 4.6.0, < 4.7.2, >= 5.0.0, < 5.0.1 4.5.1, 4.7.2, 5.0.1

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
-
Platform
.NET (NuGet)
Package
System.Text.Encodings.Web
Disclosed
21.04.2021
Updated
11.10.2026 11:23

Sources and licenses

OSV / GitHub Advisory Database - GHSA-ghhp-997w-qr28 - CC BY 4.0

Vulnerability history: System.Text.Encodings.Web

All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
5
First → latest
10.2018 04.2021
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 2
  • Medium 2

Disclosures per year

  1. .NET Core Remote Code Execution Vulnerability this entry
    Critical · 9.8 CVE-2021-26701 >= 4.0.0, < 4.5.1, >= 4.6.0, < 4.7.2, >= 5.0.0, < 5.0.1 4.5.1, 4.7.2, 5.0.1
  2. Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core
    Medium CVE-2017-0248 >= 4.0.0, < 4.0.1, >= 4.3.0, < 4.3.1 4.0.1, 4.3.1
  3. ASP.NET Core fails to properly validate web requests
    High · 7.5 CVE-2017-0247 >= 4.0.0, < 4.0.1, >= 4.3.0, < 4.3.1 4.0.1, 4.3.1
  4. Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc
    Medium · 5.3 CVE-2017-0256 >= 4.0.0, < 4.0.1, >= 4.3.0, < 4.3.1 4.0.1, 4.3.1
  5. High severity vulnerability that affects Microsoft.AspNetCore.Mvc
    High · 7.3 CVE-2017-0249 >= 4.0.0, < 4.0.1, >= 4.3.0, < 4.3.1 4.0.1, 4.3.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.