ALSA-2026:99051 — Important: .NET 9.0 security, bug fix, and enhancement update

Summary

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.124
Runtime version: 9.0.23

Security Fix(es):

* dotnet8.0: dotnet11.0: dotnet9.0: dotnet10.0: ASP.NET Core Information Disclosure Vulnerability (CVE-2026-109476)
* dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-105544)
* dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: .NET Denial of Service Vulnerability (CVE-2026-109475)
* dotnet9.0: dotnet11.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114146)
* dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114147)
* dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114149)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.124 and Runtime 9.0.23 (JIRA:RHEL-302540)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

Release	Package	Fixed in
AlmaLinux · 8	aspnetcore-runtime-9.0	9.0.23-1.el8_10
AlmaLinux · 8	aspnetcore-runtime-dbg-9.0	9.0.23-1.el8_10
AlmaLinux · 8	aspnetcore-targeting-pack-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-apphost-pack-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-hostfxr-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-runtime-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-runtime-dbg-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-sdk-9.0	9.0.124-1.el8_10
AlmaLinux · 8	dotnet-sdk-9.0-source-built-artifacts	9.0.124-1.el8_10
AlmaLinux · 8	dotnet-sdk-aot-9.0	9.0.124-1.el8_10
AlmaLinux · 8	dotnet-sdk-dbg-9.0	9.0.124-1.el8_10
AlmaLinux · 8	dotnet-targeting-pack-9.0	9.0.23-1.el8_10
AlmaLinux · 8	dotnet-templates-9.0	9.0.124-1.el8_10
AlmaLinux · 8	netstandard-targeting-pack-2.1	9.0.124-1.el8_10

Vulnerabilities 6

Critical 9.0

CVE-2026-114146

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 11.0 installed on Windows Microsoft Visual Studio 2026 version 18.12 Linux Windows macOS Ubuntu Alpine Wolfi NuGet

Nov 10, 2026
High 7.5

CVE-2026-105544

.NET Elevation of Privilege Vulnerability

Improper access control in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 11.0 installed on Windows Microsoft Visual Studio 2026 version 18.12 Linux Windows macOS Ubuntu Alpine

Nov 10, 2026
High 7.5

CVE-2026-109475

.NET Denial of Service Vulnerability

Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.

Microsoft .NET 11.0 installed on Linux .NET 11.0 installed on Mac OS .NET 10.0 installed on Mac OS Linux macOS Ubuntu Alpine Wolfi NuGet

Nov 10, 2026
High 7.5

CVE-2026-114147

ASP.NET Core Denial of Service Vulnerability

Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 11.0 installed on Windows Microsoft Visual Studio 2026 version 18.12 Linux Windows macOS Ubuntu Alpine Wolfi NuGet

Nov 10, 2026
High 7.5

CVE-2026-114149

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.12 .NET 11.0 installed on Windows Linux Windows macOS Ubuntu Alpine Wolfi NuGet

Nov 10, 2026
Medium 6.1

CVE-2026-109476

ASP.NET Core Information Disclosure Vulnerability

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 11.0 installed on Windows Microsoft Visual Studio 2026 version 18.12 Linux Windows macOS Ubuntu Alpine Wolfi NuGet

Nov 10, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-105544
report
https://access.redhat.com/security/cve/CVE-2026-109475
report
https://access.redhat.com/security/cve/CVE-2026-109476
report
https://access.redhat.com/security/cve/CVE-2026-114146
report
https://access.redhat.com/security/cve/CVE-2026-114147
report
https://access.redhat.com/security/cve/CVE-2026-114149
report
https://bugzilla.redhat.com/2568441
report
https://bugzilla.redhat.com/2568442
report
https://bugzilla.redhat.com/2568443
report
https://bugzilla.redhat.com/2568446
report
https://bugzilla.redhat.com/2568449
report
https://bugzilla.redhat.com/2568450
advisory
https://errata.almalinux.org/8/ALSA-2026-99051.html