limbo.watch
Menu

Likely permanent: GitHub doesn’t review this ecosystem

GHSA-r6pf-x897-gm86

ASP.NET Core 8 regular and composite Linux runtime tarballs on other · published in dotnet/aspnetcore

Read the advisory on GitHub ↗

Fixed in 8.0.33. Dependabot, npm audit and OSV-Scanner probably never will. Find it in your project

Facts

Severity
High · CVSS score 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions (ASP.NET Core 8 regular and composite Linux runtime tarballs)
>= 8.0.0, < 8.0.33As entered by the maintainer. Not reviewed.
Fixed in (ASP.NET Core 8 regular and composite Linux runtime tarballs)
8.0.33
Affected versions (ASP.NET Core 8 Linux targeting-pack tarballs)
>= 8.0.0, < 8.0.33As entered by the maintainer. Not reviewed.
Fixed in (ASP.NET Core 8 Linux targeting-pack tarballs)
8.0.33
Affected versions (ASP.NET Core 9 regular and composite Linux runtime tarballs)
>= 9.0.0, < 9.0.22As entered by the maintainer. Not reviewed.
Fixed in (ASP.NET Core 9 regular and composite Linux runtime tarballs)
9.0.22
Affected versions (ASP.NET Core 9 Linux targeting-pack tarballs)
>= 9.0.0, < 9.0.22As entered by the maintainer. Not reviewed.
Fixed in (ASP.NET Core 9 Linux targeting-pack tarballs)
9.0.22
Affected versions (Source-built .NET 8 Linux distributions)
>= 8.0.100, < 8.0.133As entered by the maintainer. Not reviewed.
Fixed in (Source-built .NET 8 Linux distributions)
8.0.133
Affected versions (Source-built .NET 9 Linux distributions)
>= 9.0.100, < 9.0.123As entered by the maintainer. Not reviewed.
Fixed in (Source-built .NET 9 Linux distributions)
9.0.123
Affected versions (Source-built .NET 10.0.1xx Linux distributions)
>= 10.0.100, <= 10.0.113As entered by the maintainer. Not reviewed.
Fixed in (Source-built .NET 10.0.1xx Linux distributions)
10.0.114-servicing.26522.126
Affected versions (Source-built .NET 10.0.4xx Linux distributions)
>= 10.0.400, <= 10.0.402As entered by the maintainer. Not reviewed.
Fixed in (Source-built .NET 10.0.4xx Linux distributions)
10.0.403-servicing.26523.112
Affected versions (Source-built .NET 11 preview Linux distributions)
>= 11.0.100-preview.1.26104.118, <= 11.0.100-rc.2.26504.105As entered by the maintainer. Not reviewed.
Fixed in (Source-built .NET 11 preview Linux distributions)
11.0.100-rc.3.26522.148
CVE
CVE-2026-114148 · published
GitHub Advisory Database
Not reviewed
OSV.dev
Not present
Other CVEs pointing here
None found in the CVE List

If you use ASP.NET Core 8 regular and composite Linux runtime tarballs >= 8.0.0, < 8.0.33

Upgrade to 8.0.33 or later. Dependabot, npm audit and OSV-Scanner probably never will.

Timeline

  1. 2026-10-25 19:06 UTC

    Published by the maintainers

    Cites CVE-2026-114148

  2. 2026-10-30 13:12 UTC

    Change recorded

    CVE-2026-114148 RESERVED -> PUBLISHED

  3. 2026-10-28 07:19 UTC

    First seen by Limbowatch

    not reviewed · not in OSV

  4. Not expected

    Reviewed by GitHub

    GitHub doesn’t review this ecosystem

Machine-readable record: feed/GHSA-r6pf-x897-gm86.json