diff --git a/build/dependencies.props b/build/dependencies.props
index c0129c246e..063add026b 100644
--- a/build/dependencies.props
+++ b/build/dependencies.props
@@ -28,7 +28,7 @@
     <MicrosoftAspNetCoreBenchmarkRunnerSourcesPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreBenchmarkRunnerSourcesPackageVersion>
     <MicrosoftAspNetCoreChunkingCookieManagerSourcesPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreChunkingCookieManagerSourcesPackageVersion>
     <MicrosoftAspNetCoreCookiePolicyPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreCookiePolicyPackageVersion>
-    <MicrosoftAspNetCoreCorsPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreCorsPackageVersion>
+    <MicrosoftAspNetCoreCorsPackageVersion>2.2.0-a-rtm-fix-wildcard-16567</MicrosoftAspNetCoreCorsPackageVersion>
     <MicrosoftAspNetCoreDiagnosticsAbstractionsPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreDiagnosticsAbstractionsPackageVersion>
     <MicrosoftAspNetCoreDiagnosticsPackageVersion>2.2.0-rtm-35519</MicrosoftAspNetCoreDiagnosticsPackageVersion>
     <MicrosoftAspNetCoreHostingAbstractions20PackageVersion>2.0.0</MicrosoftAspNetCoreHostingAbstractions20PackageVersion>
diff --git a/test/Microsoft.AspNetCore.Mvc.FunctionalTests/CorsTestsBase.cs b/test/Microsoft.AspNetCore.Mvc.FunctionalTests/CorsTestsBase.cs
index 3d5be3b90a..41687b9c5f 100644
--- a/test/Microsoft.AspNetCore.Mvc.FunctionalTests/CorsTestsBase.cs
+++ b/test/Microsoft.AspNetCore.Mvc.FunctionalTests/CorsTestsBase.cs
@@ -196,7 +196,7 @@ namespace Microsoft.AspNetCore.Mvc.FunctionalTests
                new[] { "true" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowCredentials).ToArray());
             Assert.Equal(
-               new[] { "*" },
+               new[] { "header1,header2" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowHeaders).ToArray());
             Assert.Equal(
                new[] { "PUT,POST" },
@@ -306,8 +306,11 @@ namespace Microsoft.AspNetCore.Mvc.FunctionalTests
                new[] { "true" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowCredentials).ToArray());
             Assert.Equal(
-               new[] { "*" },
+               new[] { "Custom" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowHeaders).ToArray());
+            Assert.Equal(
+               new[] { "GET" },
+               responseHeaders.GetValues(CorsConstants.AccessControlAllowMethods).ToArray());
 
             var content = await response.Content.ReadAsStringAsync();
             Assert.Empty(content);
@@ -338,8 +341,11 @@ namespace Microsoft.AspNetCore.Mvc.FunctionalTests
                new[] { "true" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowCredentials).ToArray());
             Assert.Equal(
-               new[] { "*" },
+               new[] { "Custom" },
                responseHeaders.GetValues(CorsConstants.AccessControlAllowHeaders).ToArray());
+            Assert.Equal(
+               new[] { "GET" },
+               responseHeaders.GetValues(CorsConstants.AccessControlAllowMethods).ToArray());
 
             var content = await response.Content.ReadAsStringAsync();
             Assert.Empty(content);