Skip to content
OpenAdvisories
High ALAS2023-2026-2009 17 CVEs

Important: dotnet10.0 security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 5, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-57108: Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-56170: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50650: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. CVE-2026-50649: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50646: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. CVE-2026-50528: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50526: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-47304: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-47303: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47302: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-47300: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Fixed packages 23

ReleasePackageFixed in
Amazon Linux · 2023 aspnetcore-runtime-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-runtime-dbg-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-targeting-pack-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-10.0-debuginfo 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host-debuginfo 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-10.0-debuginfo 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-10.0-debuginfo 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-dbg-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0-debuginfo 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0-source-built-artifacts 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-10.0 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-10.0-debuginfo 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-dbg-10.0 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-targeting-pack-10.0 0:10.0.10-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-templates-10.0 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet10.0-debuginfo 0:10.0.110-1.amzn2023.0.1
Amazon Linux · 2023 dotnet10.0-debugsource 0:10.0.110-1.amzn2023.0.1

Vulnerabilities 17

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47300.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47302.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47303.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47304.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50524.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50525.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50526.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50527.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50528.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50646.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50648.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50649.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50650.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50659.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56170.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-57108.html