ASP.NET Core: Information disclosure due to improper output encoding
Summary
ASP.NET Core in .NET 8, 9, 10 and 11 can disclose information because output is not properly encoded or escaped. According to the vendor's GitHub advisory, a crafted X-Forwarded-Prefix header can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. An unauthenticated network attacker could exploit this, but attack complexity is high and user interaction is required.
Affected
- .NET 8.0 on Windows, Linux and macOS: 8.0.0 to before 8.0.34
- .NET 9.0 on Windows, Linux and macOS: 9.0.0 to before 9.0.23
- .NET 10.0 on Windows, Linux and macOS: 10.0.0 to before 10.0.15
- .NET 11.0 previews on Windows, Linux and macOS: 11.0.0-preview.1 to before 11.0.0
- Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.45 (per CVE record)
- Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4 (per CVE record)
- Visual Studio 2026 version 18.12: the affected range in the CVE record is inconsistent. Unknown.
Fixed in
- .NET 8.0.34
- .NET 9.0.23
- .NET 10.0.15
- .NET 11.0.0
- Visual Studio: fixed builds per Microsoft Security Update Guide. Fixed build for 18.11 not independently verified.
Workaround
Unknown. No workaround is documented by the vendor. Patching is the fix.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Rapid7 rates exploitation as less likely and reports no public disclosure.
- SANS ISC lists it as not disclosed and not exploited.
- No public proof of concept found.
- Inclusion in the CISA KEV catalogue not verified.
Our recommendation
- Inventory .NET runtimes, SDKs, Visual Studio installations and ASP.NET Core applications.
- Patch to the fixed versions above, prioritising internet-facing applications.
- If patching is delayed, check whether reverse proxies forward X-Forwarded-Prefix from untrusted clients and whether PathBase is used (own suggestion, not verified by the vendor).
- Monitor NVD and CISA KEV for updates.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-109476 msrc.microsoft.com
- dotnet/announcements #508: Microsoft advisory table github.com
- dotnet/announcements #504: November 2026 ASP.NET Core security updates github.com
- .NET November 2026 servicing updates devblogs.microsoft.com
- GitLab advisory mirror: CVE-2026-109476 advisories.gitlab.com
- OffSeq Radar: CVE-2026-109476 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:33.
Original description (NVD)
Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.