high7.5
CVE-2026-70183
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges…
Impact
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | ASP.NET Core 10.0 | from 10.0 before 10.0.13 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.14 | from 17.14.0 before 17.14.42 |
| Microsoft | ASP.NET Core 9.0 | from 9.0 before 9.0.21 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.10 | from 18.10.0 before 18.10.4 |
| Microsoft | ASP.NET Core 8.0 | from 8.0 before 8.0.32 |
| Microsoft | ASP.NET Core 11.0 | from 11.0 before 11.0.0-rc.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-494h-xx7x-5frh
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-494h-xx7x-5frh
- https://github.com/dotnet/announcements/issues/460
- https://github.com/dotnet/aspnetcore/discussions/69796
- https://nvd.nist.gov/vuln/detail/CVE-2026-70183
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70183