Threats tagged 'ghsa-7phj-vgxq-r67h'

A vulnerability in ASP.NET Core's Kestrel Named Pipes transport on Windows allows a local user to claim a named pipe path by exploiting loss of protected namespace ownership during recovery when configured with CurrentUserOnly. This security feature bypass can lead to confidentiality and integrity impacts. The issue affects multiple runtime packages across .NET versions 8.0 through 11.0, with patches available in specific fixed versions. Users should update to the patched runtime versions to mitigate the risk.