undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Products covered
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
Show 31 more products
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
.NET 10.0 installed on Windows
.NET 10.0 installed on Linux
.NET 10.0 installed on Mac OS
.NET 11.0 installed on Windows
.NET 11.0 installed on Linux
.NET 11.0 installed on Mac OS
.NET 9.0 installed on Windows
.NET 9.0 installed on Linux
.NET 9.0 installed on Mac OS
.NET 8.0 installed on Windows
.NET 8.0 installed on Linux
.NET 8.0 installed on Mac OS
Microsoft .NET Framework 3.5 on Windows 11 version 26H1
Microsoft .NET Framework 3.5 on Windows Server 2012
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows 10 version 1607
Microsoft .NET Framework 4.8 on Windows Server 2012
Microsoft .NET Framework 4.8 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows Server 2016
Remediation
Release Notes Install KB5127689. Install KB5127690. Install KB5127691. Install KB5127692. Install KB5127693. Install KB5127694. Install KB5130036. Install KB5130035. Install KB5130034. Install KB5127696. Install KB5127660. Install KB5127664. Install KB5126868. Install KB5127666. Install KB5127685. Install KB5127683. Install KB5127687. Install KB5127667. Install KB5127668. Install KB5127684. Install KB5127686. Install KB5127688.
Vendor-listed fixes
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
4.8.9363.0
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0
10.0.13
11.0.0-rc.2
9.0.21
8.0.32
2.0.50727.9188 AND 3.0.30729.9171
Show 7 more fixes
2.0.50727.8987 AND 3.0.30729.8982
2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0
4.7.4150.0
4.8.4811.0
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- The vendor changed the advisory's last-updated date.
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Updated by Microsoft Security Response Center
The vendor changed the advisory after it was first published.
- Confirmed at the source
Our collector saw this advisory during a later source check.