NuGet Product Used

dotnet.exe

Product Version

.NET SDK 9.0.8

Worked before?

Unknown

Impact

It's more difficult to complete my work

Repro Steps & Context

1. Create an empty C# .NET console App project
2. Add NuGet package dependency OpenTelemetry.Instrumentation.AspNetCore version 1.0.0-rc9.14 (note the vulnerability message in nuget.org)
3. Use the dependency:

   Console.WriteLine(OpenTelemetry.Sdk.SuppressInstrumentation);

4. Restore/Build the project
5. Use dotnet list package -v diag --vulnerable, the result is "No vulnerable packages" (BUG):

   $ dotnet list package -v diag --vulnerable
   
     CACHE https://api.nuget.org/v3/registration5-gz-semver2/opentelemetry.instrumentation.aspnetcore/index.json
   
   The following sources were used:
     https://api.nuget.org/v3/index.json
     C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\
   
   The given project `VulnTestApp` has no vulnerable packages given the current sources.
   

Despite the fact that package registration endpoint contains vulnerability info:

"version": "1.0.0-rc9.14",
"vulnerabilities": [
  {
    "advisoryUrl": "https://github.com/advisories/GHSA-vh2m-22xx-q94f",
    "severity": "1"
  }
]

Also, if you add nuget.config the behavior will change:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <auditSources>
      <clear />
      <add key="NuGetAudit" value="https://api.nuget.org/v3/index.json" />
  </auditSources>
</configuration>

Now because of using another (VulnerabilityInfo) endpoints the result is (CORRECT):

$ dotnet list package -v diag --vulnerable

  CACHE https://api.nuget.org/v3/vulnerabilities/index.json
  CACHE https://api.nuget.org/v3-vulnerabilities/2025.07.31.17.40.39/vulnerability.base.json
  CACHE https://api.nuget.org/v3-vulnerabilities/2025.07.31.17.40.39/2025.08.14.05.17.51/vulnerability.update.json

The following sources were used:
   https://api.nuget.org/v3/index.json

Project `VulnTestApp` has the following vulnerable packages
   [net9.0]:
   Top-level Package                               Requested      Resolved       Severity   Advisory URL

   > OpenTelemetry.Instrumentation.AspNetCore      1.0.0-rc9.14   1.0.0-rc9.14   Moderate   https://github.com/advisories/GHSA-vh2m-22xx-q94f

Verbose Logs