CVE-2026-21218
Fixed in a distro release EPSS 1%CVSS 7.5
Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
Products: Microsoft .NET 10.0, Microsoft .NET 8.0, Microsoft .NET 9.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | System.Security.Cryptography.Cose | 8.0.2 |
| NuGet | System.Security.Cryptography.Cose | 9.0.13 |
| NuGet | System.Security.Cryptography.Cose | 10.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dotnet-10 | 10.0.103-r0 |
| Chainguard | dotnet-8 | 8.0.124-r0 |
| Chainguard | dotnet-9 | 9.0.114-r0 |
| Ubuntu 22.04 LTS | dotnet6 | no fix |
| Ubuntu 22.04 LTS | dotnet7 | no fix |
| Ubuntu 22.04 LTS | dotnet8 | 8.0.124-8.0.24-0ubuntu1~22.04.1 |
| Ubuntu 24.04 LTS | dotnet10 | 10.0.103-10.0.3-0ubuntu1~24.04.1 |
| Ubuntu 24.04 LTS | dotnet8 | 8.0.124-8.0.24-0ubuntu1~24.04.1 |
| Ubuntu 25.10 | dotnet10 | 10.0.103-10.0.3-0ubuntu1~25.10.1 |
| Ubuntu 25.10 | dotnet8 | 8.0.124-8.0.24-0ubuntu1~25.10.1 |
| Ubuntu 25.10 | dotnet9 | 9.0.114-9.0.13-0ubuntu1~25.10.1 |
| Wolfi | dotnet-10 | 10.0.103-r0 |
| Wolfi | dotnet-8 | 8.0.124-r0 |
| Wolfi | dotnet-9 | 9.0.114-r0 |