critical
CVE-2021-26701
dotnet: System.Text.Encodings.Web Remote Code Execution
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami, Photon OS. Rated lower by Red Hat (high), Oracle (high).
Description
.NET Core Remote Code Execution Vulnerability
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 5.0.4 |
| nuget::GitHub Security Advisory NuGet | System.Text.Encodings.Web, system.text.encodings.web | 4.5.1, 4.7.2, 5.0.1 |
| Photon OS 4.0 | dotnet-sdk | 6.0.428-1.ph4 |
| Oracle Linux 8 | aspnetcore-runtime-3.1, aspnetcore-runtime-5.0, aspnetcore-targeting-pack-3.1 and 20 more | 3.1.13-1.0.1.el8_3 and 5 more |
Show all 28 entries from 4 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 5.0.4 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 5.0.4 |
| nuget::GitHub Security Advisory NuGet | System.Text.Encodings.Web | 4.5.1, 4.7.2, 5.0.1 |
| nuget::GitHub Security Advisory NuGet | system.text.encodings.web | 4.5.1, 4.7.2, 5.0.1 |
| Photon OS 4.0 | dotnet-sdk | 6.0.428-1.ph4 |
| Oracle Linux 8 | aspnetcore-runtime-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-runtime-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-targeting-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-targeting-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-apphost-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-apphost-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-host | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-host-fxr-2.1 | 2.1.26-1.el8_3 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-hostfxr-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-2.1 | 2.1.26-1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-2.1 | 2.1.522-1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-2.1.5xx | 2.1.522-1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-3.1 | 3.1.113-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-5.0 | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-targeting-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-targeting-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-templates-3.1 | 3.1.113-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-templates-5.0 | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 5.0.104-1.0.1.el8_3 |
References
- https://access.redhat.com/security/cve/CVE-2021-26701
- https://github.com/dotnet/announcements/issues/178
- https://linux.oracle.com/cve/CVE-2021-26701.html
- https://linux.oracle.com/errata/ELSA-2021-0793.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/
All 20 references
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26701
- https://nvd.nist.gov/vuln/detail/CVE-2021-26701
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701
- https://www.cve.org/CVERecord?id=CVE-2021-26701