PGV-2129406 (CVE-2021-26701) flags System.Text.Encodings.Web 4.5.1, 4.7.2, 5.0.1, 8.0.0 and 9.0.0–9.0.21; its version range looks open-ended

[peter.shrosbree]

ProGet: 2026.12 (26.0.12.24), Free edition (also seen on 2026.5 before upgrading)
Vulnerability source: ISL Vulnerabilities, database generated 10/14/2026 19:23:51, last updated in our instance 10/15/2026 00:52:56
Feed: NuGet, proxying nuget.org

What we see

1. dotnet list package --vulnerable --include-transitive against the feed reported System.Text.Encodings.Web 9.0.8 as Critical.
2. The feed's NuGet registration data (/nuget/<feed>/v3/registrations/system.text.encodings.web/) carries a vulnerabilities entry (severity 3, advisoryUrl /vulnerable-nuget-package-info) on 88 versions: every 4.x and 5.0.x release including the fixed releases 4.5.1, 4.7.2 and 5.0.1, plus 8.0.0 and every 9.0.0 through 9.0.21. 6.x, 7.x, 8.0.1 and later, and 10.x carry none. Re-measured after the 10/15 database update and again after upgrading 2026.5 → 2026.12: 88 flagged versions each time.
3. The feed's own package page for 9.0.8 (Vulnerabilities tab) says "This package has no known vulnerabilities", on both 2026.5 and 2026.12.
4. Searching security.inedo.com for the package returns one record: PGV-2129406, ".NET Core Remote Code Execution Vulnerability" (CVE-2021-26701, GHSA-ghhp-997w-qr28).

The record's own text contradicts its range

The PGV-2129406 overview says it "affects System.Text.Encodings.Web, versions ≥ 4.0.0 &" — the range ends there. The same page's advisory table (from Microsoft's announcement, dotnet/announcements#178) gives:

Vulnerable	Secure
4.0.0 – 4.5.0	4.5.1
4.6.0 – 4.7.1	4.7.2
5.0.0	5.0.1

which matches GHSA-ghhp-997w-qr28 (< 4.5.1, >= 4.6.0, < 4.7.2, >= 5.0.0, < 5.0.1). The page shows "updated May 11, 2026".

Our reading

The record's machine-readable range appears to have lost its upper bounds (an open ≥ 4.0.0), so fixed releases and some later versions (8.0.0, every 9.0.x) are flagged. We cannot tell from outside why 6.x, 7.x and 8.0.1+ escape it. The NuGet registration path and the package page also disagree with each other for 9.0.8.

Ask

Could you correct PGV-2129406's affected range to the three advisory ranges above? And is it expected that the registration vulnerabilities data and the package page's Vulnerabilities tab disagree for the same package version? Happy to provide the raw registration responses.

[rhessinger]

Hi @peter.shrosbree,

Thank you for your detailed analysis of this issue. We were able to discover a version mismatch error in our NuGet V3 Package Metadata API. Once we retrieved vulnerabilities for a package name, we built the vulnerability array for each version by only checking for a version, not package name. So vulnerabilities that had multiple package names associated could show for multiple packages. This is only an issue with the NuGet API, as internal ProGet mechanisms check differently. Turns out this has been an issue for quite a while now, but it only became noticeable once we launched the NuGet Vulnerability API implementation in 2026.11. We will have this fixed, PG-3410, in tomorrows release of ProGet 2026.13. There is also an issue, PG-3401, that fixes an issue in the NuGet Vulnerability API when a single version is affected.

As for the security.inedo.com page for PG-2129406, the version range is actually correct. The version range of ≥ 4.0.0 & < 4.5.1 is the same as [4.0.0,4.5.1) which means versions greater than or equal to 4.0.0 and less than 4.5.1. That is why the package in the ProGet UI did not display a vulnerability for 8.0.0 - 9.0.21.

Please let us know if you need better clarification on any of this.

Thanks,
Rich