Microsoft – the vulnerability appears to be longstanding and affects all supported versions of ASP.NET Core including versions 8 9 and the 10 pre-release and even ASP.NET Core 2.3 which runs on the Windows-only .NET Framework developers can patch the .NET SDK by downloading the latest version or update to the latest version of the Kestrel.Core package (2.3.6) via the NuGet package manager
