CVE-2026-109476

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An information disclosure vulnerability (CVE-2026-109476) has been identified in how ASP.NET Core builds cookie paths. ASP.NET Core copies the request's path base, the URL prefix an application is served under, unescaped into the Path attribute of the cookies it sets, so a path base containing a semicolon can add cookie attributes of an attacker's choosing.

Per CWE-116: Improper Encoding or Escaping of Output, the weakness is a product preparing a structured message for another component without encoding or escaping its data correctly, so the intended structure of the message is not preserved.

Microsoft's advisory lists ASP.NET Core 8.0 through 11.0, where the forwarded headers middleware can take the path base from an X-Forwarded-Prefix header; .NET 6 is past end of life and is not assessed there. HeroDevs confirmed that 6.0 writes the same unescaped cookie paths on Windows, Linux, and macOS, but its middleware does not read that header. A 6.0 application is exposed only when its own code sets the path base from a request-controlled value, such as a proxy header.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.48 or earlier that sets PathBase from a request-controlled value.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.Authentication, Microsoft.AspNetCore.Antiforgery and Microsoft.AspNetCore.Mvc.ViewFeatures
• Affected versions:
  • >= 6.0.0 <= 6.0.48
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.49

Vulnerability Info

This Medium-severity vulnerability is found in the cookie path handling of the ASP.NET Core shared framework.

Three components default a cookie's Path to the request's PathBase: RequestPathBaseCookieBuilder, which authentication cookies use, the antiforgery token store, and MVC's CookieTempDataProvider. Before the fix, the value was written into the Set-Cookie header as is. In that header a semicolon ends the Path attribute, and the browser reads whatever follows as further attributes, such as a different Domain or Path. Microsoft rates the impact as information disclosure that requires user interaction.

The fix percent-encodes ; as %3B whenever a cookie path is derived from PathBase. Commas are left unescaped, because browsers match cookie paths byte for byte and escaping them would stop cookies being sent for existing path bases that contain one. Paths set explicitly by the application are unchanged. Cookies from the OAuth, OpenID Connect and Identity handlers inherit the fix through RequestPathBaseCookieBuilder.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  • NES for .NET 6.0.49 or later
  • .NET / ASP.NET Core 10.0.15 or later
  • .NET / ASP.NET Core 11.0.0 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Raffaello Tamagnini, as credited in Microsoft's advisory.