crítica
CVE-2026-40372
ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA, Red Hat, Bitnami. Más baja según Amazon (alta), Ubuntu (media).
Descripción
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | aspnet-core | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | Microsoft.AspNetCore.DataProtection, microsoft.aspnetcore.dataprotection | 10.0.7 |
| alpine 3.23 | dotnet10-runtime | 10.0.7-r0 |
| alpine 3.24 | dotnet10-runtime | 10.0.7-r0 |
| alpine edge | dotnet10-runtime | 10.0.7-r0 |
| amazon linux 2023 | aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 y 20 más | 10.0.7-1.amzn2023.0.1 y 1 más |
| rapidfort amazon linux 2023 | dotnet, dotnet-host | 10.0.107-1.amzn2023.0.1 y 1 más |
| rapidfort ubuntu 20.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 22.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 24.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| ubuntu 24.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~24.04.1 |
| ubuntu 25.10 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~25.10.1 |
Mostrar las 40 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | aspnet-core | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | Microsoft.AspNetCore.DataProtection | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | microsoft.aspnetcore.dataprotection | 10.0.7 |
| alpine 3.23 | dotnet10-runtime | 10.0.7-r0 |
| alpine 3.24 | dotnet10-runtime | 10.0.7-r0 |
| alpine edge | dotnet10-runtime | 10.0.7-r0 |
| amazon linux 2023 | aspnetcore-runtime-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-runtime-dbg-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-dbg-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0-source-built-artifacts | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-aot-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-aot-10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-dbg-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet10.0-debugsource | 10.0.107-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet | 10.0.107-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 10.0.7-1.amzn2023.0.1 |
| rapidfort ubuntu 20.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 20.04 | dotnet7 | sin corrección indicada |
| rapidfort ubuntu 22.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 22.04 | dotnet7 | sin corrección indicada |
| rapidfort ubuntu 24.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 24.04 | dotnet7 | sin corrección indicada |
| ubuntu 24.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~24.04.1 |
| ubuntu 25.10 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~25.10.1 |
| ubuntu 26.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~26.04.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-40372
- https://bugzilla.redhat.com/show_bug.cgi?id=2460224
- https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/
- https://github.com/dotnet/announcements/issues/395
- https://github.com/dotnet/aspnetcore
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-9mv3-2cwr-p262
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
- https://nvd.nist.gov/vuln/detail/CVE-2026-40372