CVE-2026-109476 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-109476

CVE-2026-109476

Published:November 10, 2026

Updated:November 13, 2026

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

Affected Packages

Microsoft.AspNetCore.Mvc.ViewFeatures (DOT_NET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

Microsoft.AspNetCore.Antiforgery (DOT_NET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

Microsoft.AspNetCore.Mvc.ViewFeatures (DOT_NET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

Microsoft.AspNetCore.Antiforgery (DOT_NET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

Microsoft.AspNetCore.Mvc.ViewFeatures (DOT_NET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

Microsoft.AspNetCore.Authentication (DOT_NET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

Microsoft.AspNetCore.Antiforgery (DOT_NET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

Microsoft.AspNetCore.Authentication (DOT_NET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

Microsoft.AspNetCore.Authentication (DOT_NET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

Microsoft.AspNetCore.Mvc.ViewFeatures (DOT_NET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

Microsoft.AspNetCore.Authentication (DOT_NET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

Microsoft.AspNetCore.Components.Endpoints (DOT_NET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.2.26159.112 <11.0.0

Fix Suggestion:

Update to version 11.0.0

Microsoft.AspNetCore.Antiforgery (DOT_NET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

https://github.com/dotnet/dotnet.git (GITHUB):

Affected version(s) >=v11.0.0-preview.1.26104.118 <v11.0.0 || >=v11.0.0-rc.1.26425.128 <v11.0.0

Fix Suggestion:

Update to version v11.0.0

https://github.com/dotnet/aspnetcore.git (GITHUB):

Affected version(s) >=v9.0.0-rc.1.24452.1 <v9.0.23

Fix Suggestion:

Update to version v9.0.23

https://github.com/dotnet/aspnetcore.git (GITHUB):

Affected version(s) >=v8.0.0-rc.1.23421.29 <v8.0.34

Fix Suggestion:

Update to version v8.0.34

https://github.com/dotnet/dotnet.git (GITHUB):

Affected version(s) >=v10.0.0-rc.1.25451.107 <v10.0.15

Fix Suggestion:

Update to version v10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=11.0.0-rc.1.26425.128 <11.0.0 || >=11.0.0-preview.1.26104.118 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

Related Resources (16)

https://github.com/dotnet/aspnetcore/commit/1fa5639647ddd2061bafe2ccf60bdc1c345b0b34

https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md

https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34

https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15

https://github.com/dotnet/aspnetcore/security/advisories/GHSA-xhj5-c3g8-pfj8

https://github.com/dotnet/announcements/issues/508

https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md

https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23

https://github.com/dotnet/aspnetcore/commit/7ce5a6b05d4d6694bb688bf7053ebb594c00a8e5

https://github.com/dotnet/aspnetcore

https://github.com/dotnet/aspnetcore/discussions/70471

https://nvd.nist.gov/vuln/detail/CVE-2026-109476

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109476

https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md

https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md

https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0

Do you need more information?

CVSS v4

Base Score:

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

NONE

Vulnerable System Availability

NONE

Subsequent System Confidentiality

HIGH

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Improper Encoding or Escaping of Output

CWE-116

EPSS

Base Score:

0.64

AI app security

Mend AI

Application security

Mend AppSec

Dependency management

Mend Renovate

Expand coverage

Runtime and beyond

AI security

Code security

Supply chain security

Compliance & reporting

vs. AI security tools

vs. AppSec tools

Buyer’s guides

About Mend.io

Partners & people

Customers

Learn & explore

Guides

Developers hub