GHSA-g4vj-cjjj-v7hg

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A data-authenticity verification weakness (GHSA-g4vj-cjjj-v7hg) has been identified in the NuGet client that ships with the .NET SDK. When downloading a package, the client validated the package signature but did not verify that the downloaded package's identity, its ID and version, matched the identity that was requested. A compromised or misconfigured package source could therefore serve a different package than the one requested, and the client would accept it. This is a defense-in-depth hardening: the fix adds validation of the package ID and version during download, in addition to the existing package signature validation.

Per CWE-345: Insufficient Verification of Data Authenticity, Insufficient Verification of Data Authenticity is defined as a product not sufficiently verifying the origin or authenticity of data, in a way that causes it to accept invalid data.

This issue affects the NuGet client bundled with .NET SDK 6.0.0 <= 6.0.41 in NES-supported environments. Microsoft serviced its supported NuGet client lines through the upstream patches published on April 14, 2026 (NuGet 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, and 7.3.1).

‍

Details

Module Info

• Product: .NET SDK
• Affected packages:
  
  • NuGet.CommandLine
  • NuGet.Packaging
  • NuGet.Protocol
• Affected versions: .NET SDK >= 6.0.0 <= 6.0.41
• GitHub repository: https://github.com/NuGet/NuGet.Client
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
  • Windows Installer
  • Docker
• Fixed in: NES for .NET 6.0.42

Vulnerability Info

This Low-severity vulnerability is found in the NuGet client that the .NET SDK bundles for restoring, downloading, and packing NuGet packages. On the package-download path the client verified the package signature but never compared the identity of the package it received, its ID and version, against the identity it had requested. Because only the signature was checked, a package source that was compromised or misconfigured could return a payload whose contents differ from the requested ID and version, and the client would accept and use it rather than rejecting the mismatch. The remediation adds an explicit package ID and version identity check during download, layered on top of the existing signature validation, so a package that does not match the requested identity is now rejected. The weakness is defense-in-depth in nature and is rated Low severity, as signed-package tampering was already covered by signature validation.

This vulnerability has been present since at least .NET 6.0.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy. The NuGet client bundled with .NET SDK 6.0.x is the 6.3.x line, which Microsoft never patched for this advisory (the lowest upstream fix is 6.8.2), because .NET 6 is End-of-Life. There is therefore no in-place 6.3.x upstream fix — remediation requires either NES or a forward move to a newer SDK.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported .NET SDK that bundles a patched NuGet client, one of:
  
  • NuGet client >= 4.9.7
  • NuGet client >= 5.11.7
  • NuGet client >= 6.8.2
  • NuGet client >= 6.11.2
  • NuGet client >= 6.12.5
  • NuGet client >= 6.14.3
  • NuGet client >= 7.0.3
  • NuGet client >= 7.3.1

• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET SDK 6.0.42 or later.

‍

Credits

• splitline from DEVCORE (finder)