Red Hat Security Advisory: .NET 9.0 security update

Fixed packages 23

Vulnerabilities 2

• High 7.5
  CVE-2026-45591

  ASP.NET Core Denial of Service Vulnerability

  Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet
  Jun 9, 2026
• Medium 6.2
  CVE-2026-45491

  .NET Tampering Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

  Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet
  Jun 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487164
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487224
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28009.json
• report
  https://access.redhat.com/security/cve/CVE-2026-45491
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45491
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45491
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491
• report
  https://access.redhat.com/security/cve/CVE-2026-45591
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45591
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45591
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591