CVE-2026-21218
High · 7.5CVSS
7.5
EPSS
1.0%
Published
Feb 10, 2026
CISA due date
—
The record
Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | System.Security.Cryptography.Cose | 10.0.0 | 10.0.3 |
| NuGet | System.Security.Cryptography.Cose | 8.0.0 | 8.0.2 |
| NuGet | System.Security.Cryptography.Cose | 9.0.0 | 9.0.13 |
| Chainguard | dotnet-10 | 0 | 10.0.103-r0 |
| Chainguard | dotnet-8 | 0 | 8.0.124-r0 |
| Chainguard | dotnet-9 | 0 | 9.0.114-r0 |
| Wolfi | dotnet-10 | 0 | 10.0.103-r0 |
| Wolfi | dotnet-8 | 0 | 8.0.124-r0 |
| Wolfi | dotnet-9 | 0 | 9.0.114-r0 |
Related vulnerabilities
- CVE-2024-43483 Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability Also affects System.Security.Cryptography.Cose
- CVE-2025-55315 Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability Also affects dotnet-8
- CVE-2024-30105 .NET Core and Visual Studio Denial of Service Vulnerability Also affects dotnet-8
- CVE-2024-43498 .NET Remote Code Execution Vulnerability Also affects dotnet-9
- CVE-2024-43499 .NET Denial of Service Vulnerability Also affects dotnet-9
- CVE-2026-32792 NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service… CWE-166