Skip to content
OpenAdvisories
High ALAS2023-2026-3366 24 CVEs

Important: dotnet10.0 security update (Amazon Linux 2023)

Published Nov 2, 2026 · Updated Nov 2, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96957: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-96237: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96236: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96233: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-84008: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-83520: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70186: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70183: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70181: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70179: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-70159: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70007: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-114148: Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. CVE-2026-109468: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-102870: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Fixed packages 23

ReleasePackageFixed in
Amazon Linux · 2023 aspnetcore-runtime-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-runtime-dbg-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 aspnetcore-targeting-pack-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-apphost-pack-10.0-debuginfo 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-host-debuginfo 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-hostfxr-10.0-debuginfo 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-10.0-debuginfo 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-runtime-dbg-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0-debuginfo 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-10.0-source-built-artifacts 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-10.0 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-aot-10.0-debuginfo 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-sdk-dbg-10.0 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-targeting-pack-10.0 0:10.0.14-1.amzn2023.0.1
Amazon Linux · 2023 dotnet-templates-10.0 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet10.0-debuginfo 0:10.0.114-1.amzn2023.0.1
Amazon Linux · 2023 dotnet10.0-debugsource 0:10.0.114-1.amzn2023.0.1

Vulnerabilities 24

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-102870.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109468.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-114148.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58280.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-69651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70007.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70159.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70175.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70179.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70181.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70183.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70186.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-70197.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-83520.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-84008.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96225.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96231.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96233.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96236.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96237.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96957.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96958.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96959.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-96960.html