本文へ移動
English version →
ログイン 新規登録
JA EN FR
SecPulse
中 6.1

Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability

CVE-2026-109476 SecPulse初出

影響パッケージ

パッケージ影響を受ける版 → 修正版
Microsoft.NET 10.0 installed on Linux
10.0.0 以上 10.0.15 未満→ 10.0.15
Microsoft.NET 10.0 installed on Mac OS
10.0.0 以上 10.0.15 未満→ 10.0.15
Microsoft.NET 10.0 installed on Windows
10.0.0 以上 10.0.15 未満→ 10.0.15
Microsoft.NET 11.0 installed on Linux
11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0
Microsoft.NET 11.0 installed on Mac OS
11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0
Microsoft.NET 11.0 installed on Windows
11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0
Microsoft.NET 8.0 installed on Linux
8.0.0 以上 8.0.34 未満→ 8.0.34
Microsoft.NET 8.0 installed on Mac OS
8.0.0 以上 8.0.34 未満→ 8.0.34
Microsoft.NET 8.0 installed on Windows
8.0.0 以上 8.0.34 未満→ 8.0.34
Microsoft.NET 9.0 installed on Linux
9.0.0 以上 9.0.23 未満→ 9.0.23
Microsoft.NET 9.0 installed on Mac OS
9.0.0 以上 9.0.23 未満→ 9.0.23
Microsoft.NET 9.0 installed on Windows
9.0.0 以上 9.0.23 未満→ 9.0.23
MicrosoftMicrosoft Visual Studio 2022 version 17.14
17.14.0 以上 17.14.45 未満→ 17.14.45
MicrosoftMicrosoft Visual Studio 2026 version 18.11
18.11.0 以上 18.11.4 未満→ 18.11.4
MicrosoftMicrosoft Visual Studio 2026 version 18.12
18.12.0 未満→ 18.12.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-x64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.osx-arm64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.osx-x64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-arm64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-x64
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-x86
11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508

CVSS Details

  • Version: 3.1
  • Severity: Medium
  • Score: 6.1 (base score)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
  • Weakness: CWE-116

Affected Platforms

  • Platforms: Windows, Linux, macOS
  • Architectures: All

Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package Affected version Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0-rc.1.23421.29, <= 8.0.33 8.0.34
Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0-rc.1.23421.29, <= 8.0.33 8.0.34
Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0-rc.1.23421.29, <= 8.0.33 8.0.34
[Micros…

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

当サイトでは、アクセス解析と広告の効果測定のために Cookie を使います。株式会社Game のサイト共通の設定です。 詳しく