Skip to content
OpenAdvisories
High ALAS2023-2026-2048 10 CVEs

Important: dotnet9.0 security update (Amazon Linux 2023)

Published Aug 17, 2026 · Updated Aug 17, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-57108: Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50649: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-50526: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. CVE-2026-47304: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-47303: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Fixed packages 23

ReleasePackageFixed in
Amazon Linux · 2023 aspnetcore-runtime-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-runtime-dbg-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-targeting-pack-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-9.0-debuginfo 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host-debuginfo 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-9.0-debuginfo 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-9.0-debuginfo 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-dbg-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0-debuginfo 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0-source-built-artifacts 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-9.0 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-9.0-debuginfo 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-dbg-9.0 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-targeting-pack-9.0 0:9.0.18-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-templates-9.0 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 dotnet9.0-debugsource 0:9.0.119-1.amzn2023.0.1
Amazon Linux · 2023 netstandard-targeting-pack-2.1 0:9.0.119-1.amzn2023.0.1

Vulnerabilities 10

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47303.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47304.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50524.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50525.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50526.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50527.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50648.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50649.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-57108.html