3 ms·

It sounds like this is anything built upon Kestrel which is a lot. I was going to try to list it all here, but holy cow.

• nirvana99 1y ago
  ASP.NET Core: >= 6.0.0 <= 6.0.36 >= 8.0.0 <= 8.0.20 >= 9.0.0 <= 9.0.9 <= 10.0.0-rc.1 Microsoft.AspNetCore.Server.Kestrel.Core: <= 2.3.0
  • Uvix 1y ago
    Those are just the ones they're fixing. Versions <6.0 are still vulnerable, they're just not getting patched because they're out of support.
    • ozim 1y ago
      Don't use out of support software or at least don't use out of support software exposed to the internet.
      • pixl97 1y ago
        Internal attacks are easy enough in a large enough network.
  • haydenbarnes 1y ago
    >= 6.0.0 <= 6.0.36 versions are not being fixed by Microsoft. Fixes are available for .NET 6 from HeroDevs ongoing security support for .NET 6, called NES* for .NET. *never ending support
    • Bluescreenbuddy 1y ago
      7 is also EOL. It did not receive a patch. Last time it was updated was May 2024