NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
MEDIUM severity

CVE-2019-1075 — Microsoft.AspNetCore.App

MEDIUM

CVE-2019-1075 is a medium-severity (CVSS 6.1) Open Redirect vulnerability in Microsoft.AspNetCore.App. A fix is available for Microsoft.AspNetCore.App — see the affected versions and patch details below.

Open redirect in ASP.NET Core

Also known asGHSA-prrf-397v-83xh
Published
Updated
Affected
7 pkgs
Patched
7 / 7
Exploits
None indexed
Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs86th percentile — riskier than 86% of all scored CVEsHighest risk
0.00%1.10%2.21%3.31%0.4%2.6%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

7 pkgs affected
.NETMicrosoft.AspNetCore.App.NETMicrosoft.AspNetCore.App.NETMicrosoft.AspNetCore.All.NETMicrosoft.AspNetCore.All.NETMicrosoft.AspNetCore.Server.IIS.NETMicrosoft.AspNetCore.Server.HttpSys.NETMicrosoft.AspNetCore.Server.HttpSys

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.

Affected Packages

7 total 7 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetMicrosoft.AspNetCore.App≥ 2.2.0&&< 2.2.62.2.6dotnet add package Microsoft.AspNetCore.App --version 2.2.6
.NETNuGetMicrosoft.AspNetCore.App≥ 2.1.0&&< 2.1.122.1.12dotnet add package Microsoft.AspNetCore.App --version 2.1.12
.NETNuGetMicrosoft.AspNetCore.All≥ 2.2.0&&< 2.2.62.2.6dotnet add package Microsoft.AspNetCore.All --version 2.2.6
.NETNuGetMicrosoft.AspNetCore.All≥ 2.1.0&&< 2.1.122.1.12dotnet add package Microsoft.AspNetCore.All --version 2.1.12
.NETNuGetMicrosoft.AspNetCore.Server.IIS≥ 2.2.0&&< 2.2.62.2.6dotnet add package Microsoft.AspNetCore.Server.IIS --version 2.2.6
.NETNuGetMicrosoft.AspNetCore.Server.HttpSys≥ 2.2.0&&< 2.2.62.2.6dotnet add package Microsoft.AspNetCore.Server.HttpSys --version 2.2.6

Affected Products

1 product · 2 configurations
Application
asp.net coremicrosoft
2 versions
2.12.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.AspNetCore.App, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Microsoft.AspNetCore.App to 2.2.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-1075 is resolved across your whole dependency graph.

  3. Workarounds

    Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Frequently Asked Questions

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.
O3 Security · Impact-Aware SCA

Is CVE-2019-1075 in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2019-1075: Microsoft.AspNetCore — Fixed in 2.2.6