{"answers":{"affected":"2 open source packages ship an affected version, including EnhancedLinq.Async.","exploited":"There is no known exploitation of GHSA-32wq-ppwg-3w4m in the wild and no public exploit code.","fix":"Upgrade EnhancedLinq.Async to 1.0.0-beta.3 or later.","what":"GHSA-32wq-ppwg-3w4m is a denial of service vulnerability in EnhancedLinq.Async, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-32wq-ppwg-3w4m and fix it if it is affected.\n\nWhat it is: GHSA-32wq-ppwg-3w4m is a denial of service vulnerability in EnhancedLinq.Async, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-32wq-ppwg-3w4m in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- EnhancedLinq.Async (NuGet): affected from 1.0.0-beta.1; fixed in 1.0.0-beta.3\n- EnhancedLinq.Async (NuGet): affected from 1.0.0-beta.1; fixed in 1.0.0-beta.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/ (Markdown: https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/index.md)","id":"GHSA-32wq-ppwg-3w4m","markdown":"https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/index.md","name":"GHSA-32wq-ppwg-3w4m","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"NuGet library","requires_auth":"none","summary":"EnhancedLinq.Async is vulnerable to denial of service via a transitive dependency, requiring an upgrade to the latest version.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n`Microsoft.Bcl.Memory`, a transitive dependency of `EnhancedLinq.Async`, had a Denial of Service security vulnerability, [CVE-2026-26127](https://github.com/dotnet/announcements/issues/384), thus affecting `EnhancedLinq.Async` versions that had vulnerable versions of `Microsoft.Bcl.Memory` as a transitive dependency.\n\n### Patches\n`EnhancedLinq.Async` 1.0.0 Beta 3 updates the dependency on `System.Linq.AsyncEnumerable` to version 10.0.4 or newer which in turn updates the transitive dependency on `Microsoft.Bcl.Memory` from version 10.0.3 to 10.0.4 or newer, resolving the vulnerability.\n\n### Workarounds\nNo workarounds exist for this vulnerability.\n\n### How to fix the issue\n\nTo update the `EnhancedLinq.Async` NuGet package, use one of the following methods:\n\n**NuGet Package Manager UI in Visual Studio:**\n- Open the project in Visual Studio.\n- Right-click on the project in Solution Explorer and select \"Manage NuGet Packages...\" or navigate to \"Project \u003e Manage NuGet Packages\".\n- In the NuGet Package Manager window, select the \"Updates\" tab. This tab lists packages with available updates from configured package sources.\n- Select the package(s) to update. A specific version can be chosen from the dropdown, or the latest available version can be selected.\n- Click the \"Update\" button.\n\n**Using the NuGet Package Manager Console in Visual Studio:**\n- Open the project in Visual Studio.\n- Navigate to \"Tools \u003e NuGet Package Manager \u003e Package Manager Console\".\n- To update a specific package to its latest version, use the following Update-Package command:\n\n```\nUpdate-Package -Id EnhancedLinq.Async\n```\n\n**Using the .NET CLI (Command Line Interface):**\n- Open a terminal or command prompt in the project's directory.\n- To update a specific package to its latest version, use the following add package command:\n\n```\ndotnet package update EnhancedLinq.Async\n```\n\nOnce the NuGet package reference has been updated, the application must be recompiled and redeployed.","ecosystems":["NuGet"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory","id":"GHSA-32wq-ppwg-3w4m","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"NuGet","fixed":["1.0.0-beta.3"],"introduced":["1.0.0-beta.1"],"last_affected":[],"package":"EnhancedLinq.Async","purl":null,"source":"GHSA-32wq-ppwg-3w4m"},{"ecosystem":"NuGet","fixed":["1.0.0-beta.3"],"introduced":["1.0.0-beta.1"],"last_affected":[],"package":"EnhancedLinq.Async","purl":"pkg:nuget/EnhancedLinq.Async","source":"GHSA-32wq-ppwg-3w4m"}],"products":null,"published":"2026-04-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"EnhancedLinq.Async is vulnerable to denial of service via a transitive dependency, requiring an upgrade to the latest version.","url":"https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/"}