# GHSA-32wq-ppwg-3w4m: EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

> EnhancedLinq.Async is vulnerable to denial of service via a transitive dependency, requiring an upgrade to the latest version.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 1 Apr 2026

## What is GHSA-32wq-ppwg-3w4m?

GHSA-32wq-ppwg-3w4m is a denial of service vulnerability in EnhancedLinq.Async, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact
`Microsoft.Bcl.Memory`, a transitive dependency of `EnhancedLinq.Async`, had a Denial of Service security vulnerability, [CVE-2026-26127](https://github.com/dotnet/announcements/issues/384), thus affecting `EnhancedLinq.Async` versions that had vulnerable versions of `Microsoft.Bcl.Memory` as a transitive dependency.

### Patches
`EnhancedLinq.Async` 1.0.0 Beta 3 updates the dependency on `System.Linq.AsyncEnumerable` to version 10.0.4 or newer which in turn updates the transitive dependency on `Microsoft.Bcl.Memory` from version 10.0.3 to 10.0.4 or newer, resolving the vulnerability.

### Workarounds
No workarounds exist for this vulnerability.

### How to fix the issue

To update the `EnhancedLinq.Async` NuGet package, use one of the following methods:

**NuGet Package Manager UI in Visual Studio:**
- Open the project in Visual Studio.
- Right-click on the project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
- In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from configured package sources.
- Select the package(s) to update. A specific version can be chosen from the dropdown, or the latest available version can be selected.
- Click the "Update" button.

**Using the NuGet Package Manager Console in Visual Studio:**
- Open the project in Visual Studio.
- Navigate to "Tools > NuGet Package Manager > Package Manager Console".
- To update a specific package to its latest version, use the following Update-Package command:

```
Update-Package -Id EnhancedLinq.Async
```

**Using the .NET CLI (Command Line Interface):**
- Open a terminal or command prompt in the project's directory.
- To update a specific package to its latest version, use the following add package command:

```
dotnet package update EnhancedLinq.Async
```

Once the NuGet package reference has been updated, the application must be recompiled and redeployed.

## Which versions are affected by GHSA-32wq-ppwg-3w4m?

2 open source packages ship an affected version, including EnhancedLinq.Async.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `EnhancedLinq.Async` | NuGet | From 1.0.0-beta.1 | 1.0.0-beta.3 |
| `EnhancedLinq.Async` | NuGet | From 1.0.0-beta.1 | 1.0.0-beta.3 |

## How do I fix GHSA-32wq-ppwg-3w4m?

Upgrade EnhancedLinq.Async to 1.0.0-beta.3 or later.

## Is GHSA-32wq-ppwg-3w4m being exploited?

There is no known exploitation of GHSA-32wq-ppwg-3w4m in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-32wq-ppwg-3w4m and fix it if it is affected.

What it is: GHSA-32wq-ppwg-3w4m is a denial of service vulnerability in EnhancedLinq.Async, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-32wq-ppwg-3w4m in the wild and no public exploit code.

Affected packages and fixed versions:
- EnhancedLinq.Async (NuGet): affected from 1.0.0-beta.1; fixed in 1.0.0-beta.3
- EnhancedLinq.Async (NuGet): affected from 1.0.0-beta.1; fixed in 1.0.0-beta.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/ (Markdown: https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-32wq-ppwg-3w4m

---
From sbomify Insights: https://insights.sbomify.com/GHSA-32wq-ppwg-3w4m/
Summaries are generated and may contain mistakes; the official description above is the record.