Skip to content
cve.newCreate a CVE report

System.Text.Json

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.3
CVE-2026-120796Package fixes recorded

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Recorded fixes — Microsoft.NETCore.App.Runtime.linux-arm: 11.0.0; Microsoft.NETCore.App.Runtime.linux-arm64: 11.0.0; 10 more packages. Check your release branch.

Exploitation not established

NuGet / Microsoft.NETCore.App.Runtime.linux-armNuGet / Microsoft.NETCore.App.Runtime.linux-arm64NuGet / Microsoft.NETCore.App.Runtime.linux-musl-arm
System.Text.Json NuGet
Affected range Recorded fix
From 11.0.0-preview.1.26104.118 before 11.0.0Ecosystem versions11.0.0

Version evidence: OSV · GHSA-cpw3-h88j-9f6x

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0-preview.1.26104.118"
        },
        {
          "fixed": "11.0.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}