ALSA-2026:41895 — Important: .NET 9.0 security, bug fix, and enhancement update

Summary

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
* dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

Release	Package	Fixed in
AlmaLinux · 10	aspnetcore-runtime-9.0	9.0.18-1.el10_2
AlmaLinux · 10	aspnetcore-runtime-dbg-9.0	9.0.18-1.el10_2
AlmaLinux · 10	aspnetcore-targeting-pack-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-apphost-pack-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-hostfxr-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-runtime-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-runtime-dbg-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-sdk-9.0	9.0.119-1.el10_2
AlmaLinux · 10	dotnet-sdk-9.0-source-built-artifacts	9.0.119-1.el10_2
AlmaLinux · 10	dotnet-sdk-aot-9.0	9.0.119-1.el10_2
AlmaLinux · 10	dotnet-sdk-dbg-9.0	9.0.119-1.el10_2
AlmaLinux · 10	dotnet-targeting-pack-9.0	9.0.18-1.el10_2
AlmaLinux · 10	dotnet-templates-9.0	9.0.119-1.el10_2
AlmaLinux · 10	netstandard-targeting-pack-2.1	9.0.119-1.el10_2

Vulnerabilities 17

High 8.8

CVE-2026-47300

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
High 8.8

CVE-2026-47303

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
High 8.2

CVE-2026-50528

.NET Security Feature Bypass Vulnerability

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 8.1

CVE-2026-47304

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.8

CVE-2026-50646

.NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jul 14, 2026
High 7.8

CVE-2026-50649

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine

Jul 14, 2026
High 7.8

CVE-2026-50650

.NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet

Jul 14, 2026
High 7.5

CVE-2026-47302

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50524

.NET Framework Denial of Service Vulnerability

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50525

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50527

.NET Framework Denial of Service Vulnerability

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50648

.NET Framework Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50651

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-56170

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu NuGet

Jul 14, 2026
High 7.5

CVE-2026-57108

.NET Denial of Service Vulnerability

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.0

CVE-2026-50526

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
Medium 6.5

CVE-2026-50659

.NET Spoofing Vulnerability

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-47300
report
https://access.redhat.com/security/cve/CVE-2026-47302
report
https://access.redhat.com/security/cve/CVE-2026-47303
report
https://access.redhat.com/security/cve/CVE-2026-47304
report
https://access.redhat.com/security/cve/CVE-2026-50524
report
https://access.redhat.com/security/cve/CVE-2026-50526
report
https://access.redhat.com/security/cve/CVE-2026-50527
report
https://access.redhat.com/security/cve/CVE-2026-50528
report
https://access.redhat.com/security/cve/CVE-2026-50646
report
https://access.redhat.com/security/cve/CVE-2026-50648
report
https://access.redhat.com/security/cve/CVE-2026-50649
report
https://access.redhat.com/security/cve/CVE-2026-50650
report
https://access.redhat.com/security/cve/CVE-2026-50651
report
https://access.redhat.com/security/cve/CVE-2026-50659
report
https://access.redhat.com/security/cve/CVE-2026-56170
report
https://access.redhat.com/security/cve/CVE-2026-57108
report
https://bugzilla.redhat.com/2499217
report
https://bugzilla.redhat.com/2500109
report
https://bugzilla.redhat.com/2500189
report
https://bugzilla.redhat.com/2500492
report
https://bugzilla.redhat.com/2500502
report
https://bugzilla.redhat.com/2500509
report
https://bugzilla.redhat.com/2500515
report
https://bugzilla.redhat.com/2500556
report
https://bugzilla.redhat.com/2500562
report
https://bugzilla.redhat.com/2500563
report
https://bugzilla.redhat.com/2500565
report
https://bugzilla.redhat.com/2500577
report
https://bugzilla.redhat.com/2500581
report
https://bugzilla.redhat.com/2500587
report
https://bugzilla.redhat.com/2500593
advisory
https://errata.almalinux.org/10/ALSA-2026-41895.html
report
https://www.redhat.com/security/data/cve/CVE-2026-50525.html

Important: .NET 9.0 security, bug fix, and enhancement update

Summary

Fixed packages 14

Vulnerabilities 17

ASP.NET Core Elevation of Privilege Vulnerability

ASP.NET Core Elevation of Privilege Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Framework Remote Code Execution Vulnerability

.NET Remote Code Execution Vulnerability

.NET Framework Elevation of Privilege Vulnerability

.NET Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Tampering Vulnerability

.NET Spoofing Vulnerability

References