https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:12:32.317905+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:0805 ALSA-2024:0805 — Important: dotnet7.0 security update 2026-10-03T14:12:32.815866+00:00

Affected: AlmaLinux:9: aspnetcore-runtime-7.0, AlmaLinux:9: aspnetcore-targeting-pack-7.0, AlmaLinux:9: dotnet-apphost-pack-7.0, AlmaLinux:9: dotnet-hostfxr-7.0, AlmaLinux:9: dotnet-runtime-7.0, AlmaLinux:9: dotnet-sdk-7.0, AlmaLinux:9: dotnet-sdk-7.0-source-built-artifacts, AlmaLinux:9: dotnet-targeting-pack-7.0, AlmaLinux:9: dotnet-templates-7.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.116 and .NET Runtime 7.0.16.

Security Fix(es):

* dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-01701 bdu:2024-01701 2026-10-03T14:12:32.815988+00:00 bdu:2024-01701 https://cve.radiocsirt.org/vuln/bell-cve-2024-21386 BELL-CVE-2024-21386 2026-10-03T14:12:32.816014+00:00

Affected: Alpaquita:stream: dotnet6-build, Alpaquita:stream: dotnet6-runtime

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0129 certfr-2024-avi-0129 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Microsoft .Net</span>. Elles permettent à un at… 2026-10-03T14:12:32.816046+00:00 certfr-2024-avi-0129 https://cve.radiocsirt.org/vuln/cleanstart-2025-qc74254 CLEANSTART-2025-QC74254 — .NET Denial of Service Vulnerability 2026-10-03T14:12:32.816073+00:00

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-21386 affects multiple packages. . See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-350736 EUVD-2026-350736 2026-10-03T14:12:32.816113+00:00 EUVD-2026-350736 https://cve.radiocsirt.org/vuln/fkie_cve-2024-21386 fkie_cve-2024-21386 2026-10-03T14:12:32.816133+00:00

.NET Denial of Service Vulnerability

 https://cve.radiocsirt.org/vuln/ghsa-g74q-5xw3-j7q9 GHSA-g74q-5xw3-j7q9 — Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability 2026-10-03T14:12:32.816164+00:00

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET 6.0, ASP.NET 7.0 and, ASP.NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A vulnerability exists in ASP.NET applications using SignalR where a malicious client can result in a denial-of-service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/295

### Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## Affected software

* Any .NET 6.0 application running on .NET 6.0.26 or earlier. * Any .NET 7.0 application running on .NET 7.0.15 or earlier. * Any .NET 8.0 application running on .NET 8.0.1 or earlier.

## Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### ASP.NET 6.0

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | <= 6.0.26 | 6.0.27 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | <= 6.0.26 | 6.0.27 [Microsof…

 https://cve.radiocsirt.org/vuln/gsd-2024-21386 gsd-2024-21386 2026-10-03T14:12:32.816499+00:00 gsd-2024-21386 https://cve.radiocsirt.org/vuln/msrc_cve-2024-21386 msrc_CVE-2024-21386 — .NET Denial of Service Vulnerability 2026-10-03T14:12:32.816521+00:00 msrc_CVE-2024-21386 https://cve.radiocsirt.org/vuln/rhsa-2024:0805 RHSA-2024:0805 — Red Hat Security Advisory: dotnet7.0 security update 2026-10-03T14:12:32.816549+00:00

crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard dotnet: Denial of Service in SignalR server dotnet: Denial of Service in X509Certificate2

 https://cve.radiocsirt.org/vuln/rhsa-2024:0814 RHSA-2024:0814 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update 2026-10-03T14:12:32.816584+00:00

dotnet: Denial of Service in SignalR server dotnet: Denial of Service in X509Certificate2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-21386 UBUNTU-CVE-2024-21386 2026-10-03T14:12:32.816615+00:00

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8

.NET Denial of Service Vulnerability

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0365 WID-SEC-W-2024-0365 — Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung 2026-10-03T14:12:32.816662+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Developer Tools ausnutzen, um beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.