ProGet: 2026.12 (26.0.12.24), Free edition (also seen on 2026.5 before upgrading)
Vulnerability source: ISL Vulnerabilities, database generated 10/14/2026 19:23:51, last updated in our instance 10/15/2026 00:52:56
Feed: NuGet, proxying nuget.org
What we see
dotnet list package --vulnerable --include-transitiveagainst the feed reportedSystem.Text.Encodings.Web 9.0.8as Critical.- The feed's NuGet registration data (
/nuget/<feed>/v3/registrations/system.text.encodings.web/) carries avulnerabilitiesentry (severity 3, advisoryUrl/vulnerable-nuget-package-info) on 88 versions: every 4.x and 5.0.x release including the fixed releases 4.5.1, 4.7.2 and 5.0.1, plus 8.0.0 and every 9.0.0 through 9.0.21. 6.x, 7.x, 8.0.1 and later, and 10.x carry none. Re-measured after the 10/15 database update and again after upgrading 2026.5 → 2026.12: 88 flagged versions each time. - The feed's own package page for 9.0.8 (Vulnerabilities tab) says "This package has no known vulnerabilities", on both 2026.5 and 2026.12.
- Searching security.inedo.com for the package returns one record: PGV-2129406, ".NET Core Remote Code Execution Vulnerability" (CVE-2021-26701, GHSA-ghhp-997w-qr28).
The record's own text contradicts its range
The PGV-2129406 overview says it "affects System.Text.Encodings.Web, versions ≥ 4.0.0 &" — the range ends there. The same page's advisory table (from Microsoft's announcement, dotnet/announcements#178) gives:
| Vulnerable | Secure |
|---|---|
| 4.0.0 – 4.5.0 | 4.5.1 |
| 4.6.0 – 4.7.1 | 4.7.2 |
| 5.0.0 | 5.0.1 |
which matches GHSA-ghhp-997w-qr28 (< 4.5.1, >= 4.6.0, < 4.7.2, >= 5.0.0, < 5.0.1). The page shows "updated May 11, 2026".
Our reading
The record's machine-readable range appears to have lost its upper bounds (an open ≥ 4.0.0), so fixed releases and some later versions (8.0.0, every 9.0.x) are flagged. We cannot tell from outside why 6.x, 7.x and 8.0.1+ escape it. The NuGet registration path and the package page also disagree with each other for 9.0.8.
Ask
Could you correct PGV-2129406's affected range to the three advisory ranges above? And is it expected that the registration vulnerabilities data and the package page's Vulnerabilities tab disagree for the same package version? Happy to provide the raw registration responses.