Summary
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 8.0.132
Runtime version: 8.0.32
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
* dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
* dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
* dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
* dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
* dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
* dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222)
* dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
* dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
* dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
* dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
* dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
* dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
Bug Fix(es) and Enhancement(s):
* Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-9.8.z] (JIRA:AlmaLinux-277793)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | aspnetcore-runtime-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | aspnetcore-runtime-dbg-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | aspnetcore-targeting-pack-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-apphost-pack-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-hostfxr-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-runtime-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-runtime-dbg-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-sdk-8.0 | 8.0.132-1.el9_8 |
| AlmaLinux · 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.132-1.el9_8 |
| AlmaLinux · 9 | dotnet-sdk-dbg-8.0 | 8.0.132-1.el9_8 |
| AlmaLinux · 9 | dotnet-targeting-pack-8.0 | 8.0.32-1.el9_8 |
| AlmaLinux · 9 | dotnet-templates-8.0 | 8.0.132-1.el9_8 |
Vulnerabilities 25
-
Critical 9.4
ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
-
Critical 9.1
ASP.NET Core Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.8CVE-2026-96230 Public exploit
ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 8.1
ASP.NET Core Elevation of Privilege Vulnerability
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
.NET Denial of Service Vulnerability
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
.NET Security Feature Bypass Vulnerability
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.9
.NET Information Disclosure Vulnerability
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
Medium 5.3
MessagePack: Nested arrays can blow past buffer length limits
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] …
References
-
report
https://access.redhat.com/security/cve/CVE-2026-58280
-
report
https://access.redhat.com/security/cve/CVE-2026-66822
-
report
https://access.redhat.com/security/cve/CVE-2026-69651
-
report
https://access.redhat.com/security/cve/CVE-2026-70159
-
report
https://access.redhat.com/security/cve/CVE-2026-70175
-
report
https://access.redhat.com/security/cve/CVE-2026-70179
-
report
https://access.redhat.com/security/cve/CVE-2026-70181
-
report
https://access.redhat.com/security/cve/CVE-2026-70183
-
report
https://access.redhat.com/security/cve/CVE-2026-70186
-
report
https://access.redhat.com/security/cve/CVE-2026-70188
-
report
https://access.redhat.com/security/cve/CVE-2026-70196
-
report
https://access.redhat.com/security/cve/CVE-2026-88092
-
report
https://access.redhat.com/security/cve/CVE-2026-92707
-
report
https://access.redhat.com/security/cve/CVE-2026-96222
-
report
https://access.redhat.com/security/cve/CVE-2026-96225
-
report
https://access.redhat.com/security/cve/CVE-2026-96230
-
report
https://access.redhat.com/security/cve/CVE-2026-96231
-
report
https://access.redhat.com/security/cve/CVE-2026-96233
-
report
https://access.redhat.com/security/cve/CVE-2026-96236
-
report
https://access.redhat.com/security/cve/CVE-2026-96237
-
report
https://access.redhat.com/security/cve/CVE-2026-96238
-
report
https://bugzilla.redhat.com/2548778
-
report
https://bugzilla.redhat.com/2548781
-
report
https://bugzilla.redhat.com/2548784
-
report
https://bugzilla.redhat.com/2548786
-
report
https://bugzilla.redhat.com/2548787
-
report
https://bugzilla.redhat.com/2548790
-
report
https://bugzilla.redhat.com/2548791
-
report
https://bugzilla.redhat.com/2548792
-
report
https://bugzilla.redhat.com/2548793
-
report
https://bugzilla.redhat.com/2548796
-
report
https://bugzilla.redhat.com/2548798
-
report
https://bugzilla.redhat.com/2548799
-
report
https://bugzilla.redhat.com/2548800
-
report
https://bugzilla.redhat.com/2548802
-
report
https://bugzilla.redhat.com/2548803
-
report
https://bugzilla.redhat.com/2548804
-
report
https://bugzilla.redhat.com/2548805
-
report
https://bugzilla.redhat.com/2548806