CVE catalog
CVE-2026-32178
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.28% · Oct 25, 2026
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | dotnet10 | Not reported | 10.0.106-10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet8 | Not reported | 8.0.126-8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-runtime-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-runtime-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-runtime-dbg-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-runtime-dbg-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-targeting-pack-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | aspnetcore-targeting-pack-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-apphost-pack-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-apphost-pack-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-host-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-host-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-hostfxr-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-hostfxr-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-runtime-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-runtime-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-runtime-dbg-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-runtime-dbg-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-10.0 | Not reported | 10.0.106-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-10.0-source-built-artifacts | Not reported | 10.0.106-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-8.0 | Not reported | 8.0.126-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-8.0-source-built-artifacts | Not reported | 8.0.126-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-aot-10.0 | Not reported | 10.0.106-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-dbg-10.0 | Not reported | 10.0.106-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-sdk-dbg-8.0 | Not reported | 8.0.126-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-targeting-pack-10.0 | Not reported | 10.0.6-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-targeting-pack-8.0 | Not reported | 8.0.26-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-templates-10.0 | Not reported | 10.0.106-0ubuntu1~24.04.1 | fixed |
| Cpe | dotnet-templates-8.0 | Not reported | 8.0.126-0ubuntu1~24.04.1 | fixed |
| Cpe | netstandard-targeting-pack-2.1-8.0 | Not reported | 8.0.126-0ubuntu1~24.04.1 | fixed |
| Cpe | .net | Not reported | 10.0.6 | fixed |
| Cpe | .net | Not reported | 8.0.26 | fixed |
| Cpe | .net | Not reported | 9.0.15 | fixed |
| Cpe | visual_studio_2022 | Not reported | 17.12.19 | fixed |
| Cpe | visual_studio_2022 | Not reported | 17.14.30 | fixed |
| Cpe | .net | Not reported | 9.0.15 | fixed |
| Cpe | visual_studio_2022 | Not reported | 17.14.30 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | dotnet10 | cpe | Not reported | 10.0.106-10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet8 | cpe | Not reported | 8.0.126-8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-runtime-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-runtime-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-runtime-dbg-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-runtime-dbg-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-targeting-pack-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | aspnetcore-targeting-pack-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-apphost-pack-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-apphost-pack-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-host-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-host-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-hostfxr-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-hostfxr-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-runtime-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-runtime-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-runtime-dbg-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-runtime-dbg-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-10.0 | cpe | Not reported | 10.0.106-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-10.0-source-built-artifacts | cpe | Not reported | 10.0.106-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-8.0 | cpe | Not reported | 8.0.126-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-8.0-source-built-artifacts | cpe | Not reported | 8.0.126-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-aot-10.0 | cpe | Not reported | 10.0.106-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-dbg-10.0 | cpe | Not reported | 10.0.106-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-sdk-dbg-8.0 | cpe | Not reported | 8.0.126-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-targeting-pack-10.0 | cpe | Not reported | 10.0.6-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-targeting-pack-8.0 | cpe | Not reported | 8.0.26-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-templates-10.0 | cpe | Not reported | 10.0.106-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | dotnet-templates-8.0 | cpe | Not reported | 8.0.126-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | netstandard-targeting-pack-2.1-8.0 | cpe | Not reported | 8.0.126-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Cpe | .net | cpe | Not reported | 10.0.6 | Not reported | Not reported | Not reported |
| Cpe | .net | cpe | Not reported | 8.0.26 | Not reported | Not reported | Not reported |
| Cpe | .net | cpe | Not reported | 9.0.15 | Not reported | Not reported | Not reported |
| Cpe | visual_studio_2022 | cpe | Not reported | 17.12.19 | Not reported | Not reported | Not reported |
| Cpe | visual_studio_2022 | cpe | Not reported | 17.14.30 | Not reported | Not reported | Not reported |
| Cpe | .net | cpe | Not reported | 9.0.15 | Not reported | NVD-CVE-2026-32178 | Not reported |
| Cpe | visual_studio_2022 | cpe | Not reported | 17.14.30 | Not reported | NVD-CVE-2026-32178 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:13280]
- [https://access.redhat.com/errata/RHSA-2026:13281]
- [https://access.redhat.com/errata/RHSA-2026:13282]
- [https://access.redhat.com/errata/RHSA-2026:13283]
- [https://access.redhat.com/errata/RHSA-2026:13693]
- [https://access.redhat.com/errata/RHSA-2026:8467]
- [https://access.redhat.com/errata/RHSA-2026:8468]
- [https://access.redhat.com/errata/RHSA-2026:8469]
- [https://access.redhat.com/errata/RHSA-2026:8470]
- [https://access.redhat.com/errata/RHSA-2026:8471]
- [https://access.redhat.com/errata/RHSA-2026:8472]
- [https://access.redhat.com/errata/RHSA-2026:8473]
- [https://access.redhat.com/errata/RHSA-2026:8474]
- [https://access.redhat.com/errata/RHSA-2026:8475]
- [https://access.redhat.com/errata/RHSA-2026:9077]
- [https://access.redhat.com/errata/RHSA-2026:9080]
- [https://access.redhat.com/errata/RHSA-2026:9205]
- [https://access.redhat.com/security/cve/CVE-2026-32178]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457781]
- [https://ftp.suse.com/pub/projects/security/]
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-32178]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32178.json]
- [https://ubuntu.com/security/notices/USN-8176-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1100.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]