Skip to content

Bump Microsoft.NETCore.App.Runtime to 10.0.8 (CVE-2026-32175)#40581

Merged
benhillis merged 1 commit into
microsoft:masterfrom
benhillis:dependabot/netcore-runtime-10.0.8
May 19, 2026
Merged

Bump Microsoft.NETCore.App.Runtime to 10.0.8 (CVE-2026-32175)#40581
benhillis merged 1 commit into
microsoft:masterfrom
benhillis:dependabot/netcore-runtime-10.0.8

Conversation

@benhillis
Copy link
Copy Markdown
Member

Summary of the Pull Request

Bumps Microsoft.NETCore.App.Runtime.win-x64 and Microsoft.NETCore.App.Runtime.win-arm64 from 10.0.6 to 10.0.8 to address CVE-2026-32175 (.NET Core Tampering Vulnerability, high severity).

PR Checklist

Detailed Description of the Pull Request / Additional comments

Two open Dependabot alerts flagged the bundled .NET 10 runtime packages at 10.0.6 as vulnerable to CVE-2026-32175 (vulnerable range >= 10.0.0, <= 10.0.7; patched in 10.0.8). Both x64 and arm64 variants are updated in lockstep.

Verified 10.0.8 is published on nuget.org for both Microsoft.NETCore.App.Runtime.win-x64 and ...win-arm64. No other files in the repo reference the old version (packages.config is the only consumer; CMakeLists.txt resolves the package generically via find_nuget_package).

Validation Steps Performed

  • git grep confirmed packages.config is the only place pinning these runtime versions.
  • Confirmed 10.0.8 exists on nuget.org for both architectures.
  • Full build will be exercised by CI.

Fixes Dependabot alerts microsoft#24 and microsoft#25.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 18, 2026 21:08
@benhillis benhillis requested a review from a team as a code owner May 18, 2026 21:08
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Security patch bumping the bundled .NET 10 runtime packages from 10.0.6 to 10.0.8 to remediate CVE-2026-32175 (.NET Core tampering vulnerability) flagged by Dependabot alerts #24 and #25.

Changes:

  • Bump Microsoft.NETCore.App.Runtime.win-arm64 to 10.0.8
  • Bump Microsoft.NETCore.App.Runtime.win-x64 to 10.0.8

@benhillis
Copy link
Copy Markdown
Member Author

/azp run wsl-github-pr

@azure-pipelines
Copy link
Copy Markdown

Azure Pipelines successfully started running 1 pipeline(s).

@benhillis benhillis enabled auto-merge (squash) May 18, 2026 21:54
@benhillis benhillis marked this pull request as draft May 19, 2026 14:12
auto-merge was automatically disabled May 19, 2026 14:12

Pull request was converted to draft

@benhillis benhillis marked this pull request as ready for review May 19, 2026 14:12
@benhillis benhillis merged commit 09a8afe into microsoft:master May 19, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants