Skip to content
OpenAdvisories
High ALAS2023-2026-2010 17 CVEs

Important: dotnet8.0 security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 5, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-57108: Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-56170: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50650: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. CVE-2026-50649: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50646: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. CVE-2026-50528: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50526: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-47304: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-47303: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47302: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-47300: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Fixed packages 22

ReleasePackageFixed in
Amazon Linux · 2023 aspnetcore-runtime-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-runtime-dbg-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-targeting-pack-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-8.0-debuginfo 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host-debuginfo 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-8.0-debuginfo 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-8.0-debuginfo 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-dbg-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-8.0 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-8.0-debuginfo 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-8.0-source-built-artifacts 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-dbg-8.0 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-targeting-pack-8.0 0:8.0.29-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-templates-8.0 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet8.0-debuginfo 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 dotnet8.0-debugsource 0:8.0.129-1.amzn2023.0.1
Amazon Linux · 2023 netstandard-targeting-pack-2.1 0:8.0.129-1.amzn2023.0.1

Vulnerabilities 17

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47300.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47302.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47303.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47304.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50524.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50525.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50526.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50527.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50528.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50646.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50648.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50649.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50650.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50659.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56170.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-57108.html