CVE-2026-114156

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 11.0.0-preview.7.26381.103 through 11.0.0-rc.3.26522.148

Description Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. Specifically, the PathString.StartsWithSegments() function can mishandle percent-encoded backslashes, which may permit authorization checks to match an unintended path.

Recommendations Update ASP.NET Core to version 11.0.0.