# Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) vulnerabilities Source: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 19 October 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): 8 in the last 7 days and 8 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-70186, was published on 13 October 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. ## Counts - Last 7 days: 8 - Last 30 days: 8 - Last 90 days: 8 - All time: 27 (2 critical, 0 exploited in the wild) ## About Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) A NuGet package containing the ASP.NET Core runtime for Linux with musl libc on ARM architectures. ## Latest Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) vulnerabilities - [CVE-2026-70186: ASP.NET Core Kestrel denial of service in HTTP/3 handling](https://junglewise.ai/threats/cve-2026-70186-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-96236: Microsoft ASP.NET Core Localization denial of service](https://junglewise.ai/threats/cve-2026-96236-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70183: Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader](https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-70181: Microsoft ASP.NET Core denial of service in multipart processing](https://junglewise.ai/threats/cve-2026-70181-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70175: Microsoft ASP.NET Core Identity weak password recovery in confirmation flow](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-56170-microsoft-asp-net-core-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2025-55315: Microsoft Security Advisory : .NET Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-55315-microsoft-security-advisory-net-security-feature-bypass) (low, CVSS 3.1, published 14 Oct 2025) - [CVE-2025-24070: Microsoft Security Advisory : .NET Elevation of Privilege Vulnerability](https://junglewise.ai/threats/cve-2025-24070-microsoft-security-advisory-net-elevation-of-privilege) (low, CVSS 3.1, published 11 Mar 2025) - [CVE-2024-38229: Microsoft Security Advisory | .NET Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2024-38229-microsoft-security-advisory-net-remote-code-execution) (low, CVSS 3.1, published 8 Oct 2024) - [CVE-2024-35264: Microsoft Security Advisory | .NET Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2024-35264-microsoft-security-advisory-net-remote-code-execution) (low, CVSS 3.1, published 9 Jul 2024) - [CVE-2024-30046: Microsoft Security Advisory | .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2024-30046-microsoft-security-advisory-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 14 May 2024) - [CVE-2024-21386: Microsoft Security Advisory : .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2024-21386-microsoft-security-advisory-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 13 Feb 2024) - [CVE-2022-34716: .NET Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2022-34716-net-information-disclosure-vulnerability) (low, CVSS 3.1, published 3 Feb 2024) - [CVE-2023-33170: Microsoft Security Advisory : .NET Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2023-33170-microsoft-security-advisory-net-security-feature-bypass) (low, CVSS 3.1, published 11 Jul 2023) - [CVE-2022-23267: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-23267-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 21 Oct 2022) - [CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing](https://junglewise.ai/threats/cve-2022-24464-microsoft-net-denial-of-service-in-http-form-parsing) (high, CVSS 7.5, published 21 Oct 2022) - [CVE-2022-21986: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-21986-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 21 Oct 2022) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) - [CVE-2022-29145: Microsoft .NET denial of service in HTML form parsing](https://junglewise.ai/threats/cve-2022-29145-microsoft-net-denial-of-service-in-html-form-parsing) (high, CVSS 7.5, published 30 Aug 2022) - [CVE-2022-29117: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-29117-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 30 Aug 2022) ## Most severe Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) vulnerabilities - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-70175: Microsoft ASP.NET Core Identity weak password recovery in confirmation flow](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2022-29145: Microsoft .NET denial of service in HTML form parsing](https://junglewise.ai/threats/cve-2022-29145-microsoft-net-denial-of-service-in-html-form-parsing) (high, CVSS 7.5, published 30 Aug 2022) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) - [CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing](https://junglewise.ai/threats/cve-2022-24464-microsoft-net-denial-of-service-in-http-form-parsing) (high, CVSS 7.5, published 21 Oct 2022) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-56170-microsoft-asp-net-core-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-96236: Microsoft ASP.NET Core Localization denial of service](https://junglewise.ai/threats/cve-2026-96236-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 27 Jul 2026 | 0 | 0 | 0 | | 3 Aug 2026 | 0 | 0 | 0 | | 10 Aug 2026 | 0 | 0 | 0 | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 8 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | ## Other NuGet technologies - [Microsoft.ChakraCore (NuGet)](https://junglewise.ai/threats/technologies/microsoft-chakracore): 247 vulnerabilities - [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu): 165 vulnerabilities - [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu): 161 vulnerabilities - [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu): 161 vulnerabilities - [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86): 159 vulnerabilities - [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86): 158 vulnerabilities - [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86): 158 vulnerabilities - [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64): 156 vulnerabilities - [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64): 156 vulnerabilities - [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64): 156 vulnerabilities - [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64): 156 vulnerabilities - [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64): 156 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm, 19 October 2026.