ALSA-2026:54550 — Important: .NET 9.0 security, bug fix, and enhancement update

Summary

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120
Runtime version: 9.0.19

Security Fix(es):

* .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
* .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
* .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
* .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 (JIRA:AlmaLinux-235473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

Release	Package	Fixed in
AlmaLinux · 8	aspnetcore-runtime-9.0	9.0.19-1.el8_10
AlmaLinux · 8	aspnetcore-runtime-dbg-9.0	9.0.19-1.el8_10
AlmaLinux · 8	aspnetcore-targeting-pack-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-apphost-pack-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-hostfxr-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-runtime-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-runtime-dbg-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-sdk-9.0	9.0.120-1.el8_10
AlmaLinux · 8	dotnet-sdk-9.0-source-built-artifacts	9.0.120-1.el8_10
AlmaLinux · 8	dotnet-sdk-aot-9.0	9.0.120-1.el8_10
AlmaLinux · 8	dotnet-sdk-dbg-9.0	9.0.120-1.el8_10
AlmaLinux · 8	dotnet-targeting-pack-9.0	9.0.19-1.el8_10
AlmaLinux · 8	dotnet-templates-9.0	9.0.120-1.el8_10
AlmaLinux · 8	netstandard-targeting-pack-2.1	9.0.120-1.el8_10

Vulnerabilities 4

High 7.8

CVE-2026-62909

.NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Aug 11, 2026
High 7.5

CVE-2026-62901

.NET Denial of Service Vulnerability

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Aug 11, 2026
Medium 5.9

CVE-2026-62899

.NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Aug 11, 2026
Medium 5.9

CVE-2026-62900

.NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Aug 11, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-62899
report
https://access.redhat.com/security/cve/CVE-2026-62900
report
https://access.redhat.com/security/cve/CVE-2026-62901
report
https://access.redhat.com/security/cve/CVE-2026-62909
report
https://bugzilla.redhat.com/2512175
report
https://bugzilla.redhat.com/2512179
report
https://bugzilla.redhat.com/2512180
report
https://bugzilla.redhat.com/2512185
advisory
https://errata.almalinux.org/8/ALSA-2026-54550.html