Skip to content
OpenAdvisories
Critical ALAS2023-2026-3248 26 CVEs

Critical: dotnet9.0 security update (Amazon Linux 2023)

Published Oct 21, 2026 · Updated Oct 30, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96238: Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-96237: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96236: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96233: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-96230: Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-88092: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. CVE-2026-84008: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-83520: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70196: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70188: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-70186: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70183: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70181: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70179: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-70159: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70007: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-66822: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-109468: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Fixed packages 23

ReleasePackageFixed in
Amazon Linux · 2023 aspnetcore-runtime-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-runtime-dbg-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-targeting-pack-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-9.0-debuginfo 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host-debuginfo 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-9.0-debuginfo 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-9.0-debuginfo 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-dbg-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0-debuginfo 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-9.0-source-built-artifacts 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-9.0 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-9.0-debuginfo 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-dbg-9.0 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-targeting-pack-9.0 0:9.0.21-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-templates-9.0 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 dotnet9.0-debugsource 0:9.0.122-1.amzn2023.0.1
Amazon Linux · 2023 netstandard-targeting-pack-2.1 0:9.0.122-1.amzn2023.0.1

Vulnerabilities 26

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109468.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58280.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-66822.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-69651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70007.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70159.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70175.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70179.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70181.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70183.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70186.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70188.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70196.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-83520.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-84008.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-88092.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96225.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96230.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96231.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96233.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96236.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96237.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96238.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96958.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96959.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96960.html