CVE-2026-109476

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 8.0.0-rc.1.23421.29 through 8.0.33 ASP.NET Core versions 9.0.0-preview.1.24081.5 through 9.0.22 ASP.NET Core versions 10.0.0-preview.1.25120.3 through 10.0.14 ASP.NET Core versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148

Description Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network. A crafted X-Forwarded-Prefix can inject cookie path delimiters if PathBase-derived cookie paths do not percent-encode semicolons.

Recommendations Update ASP.NET Core versions 8.0.0-rc.1.23421.29 through 8.0.33 to version 8.0.34. Update ASP.NET Core versions 9.0.0-preview.1.24081.5 through 9.0.22 to version 9.0.23. Update ASP.NET Core versions 10.0.0-preview.1.25120.3 through 10.0.14 to version 10.0.15. Update ASP.NET Core versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 to version 11.0.0.