Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96237: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96236: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96233: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. CVE-2026-84008: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-83520: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70186: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70183: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70181: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70179: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-70159: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-70007: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-114148: Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. CVE-2026-111497: A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution. CVE-2026-109468: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-102870: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | aspnetcore-runtime-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | aspnetcore-runtime-dbg-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | aspnetcore-targeting-pack-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-apphost-pack-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-apphost-pack-8.0-debuginfo | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-host | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-host-debuginfo | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-hostfxr-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-hostfxr-8.0-debuginfo | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-runtime-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-runtime-8.0-debuginfo | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-runtime-dbg-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-sdk-8.0 | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-sdk-8.0-debuginfo | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-sdk-8.0-source-built-artifacts | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-sdk-dbg-8.0 | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-targeting-pack-8.0 | 0:8.0.33-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet-templates-8.0 | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet8.0-debuginfo | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | dotnet8.0-debugsource | 0:8.0.133-1.amzn2023.0.1 |
| Amazon Linux · 2023 | netstandard-targeting-pack-2.1 | 0:8.0.133-1.amzn2023.0.1 |
Vulnerabilities 25
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
High 8.8
ASP.NET Core Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Remote Code Execution Vulnerability
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.1
ASP.NET Core Elevation of Privilege Vulnerability
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-102870.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109468.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-111497.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-114148.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-58280.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-69651.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70007.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70175.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70181.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70186.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-70197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-83520.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-84008.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96222.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96225.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96231.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96233.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96236.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96237.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96958.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96959.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-96960.html