RHSA-2026:41895 — Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Fixed packages 21

Release	Package	Fixed in
Red Hat · RHEL 10 enterprise_linux:10.2	aspnetcore-runtime-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	aspnetcore-runtime-dbg-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	aspnetcore-targeting-pack-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-apphost-pack-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-apphost-pack-9.0-debuginfo	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-hostfxr-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-hostfxr-9.0-debuginfo	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-runtime-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-runtime-9.0-debuginfo	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-runtime-dbg-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-9.0	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-9.0-debuginfo	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-9.0-source-built-artifacts	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-aot-9.0	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-aot-9.0-debuginfo	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-sdk-dbg-9.0	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-targeting-pack-9.0	0:9.0.18-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet-templates-9.0	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet9.0	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	dotnet9.0-debugsource	0:9.0.119-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2	netstandard-targeting-pack-2.1	0:9.0.119-1.el10_2

Vulnerabilities 17

High 8.8

CVE-2026-47300

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
High 8.8

CVE-2026-47303

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
High 8.2

CVE-2026-50528

.NET Security Feature Bypass Vulnerability

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 8.1

CVE-2026-47304

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.8

CVE-2026-50646

.NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jul 14, 2026
High 7.8

CVE-2026-50649

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine

Jul 14, 2026
High 7.8

CVE-2026-50650

.NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet

Jul 14, 2026
High 7.5

CVE-2026-47302

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50524

.NET Framework Denial of Service Vulnerability

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50525

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50527

.NET Framework Denial of Service Vulnerability

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50648

.NET Framework Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-50651

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.5

CVE-2026-56170

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu NuGet

Jul 14, 2026
High 7.5

CVE-2026-57108

.NET Denial of Service Vulnerability

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Microsoft .NET 9.0 runtime .NET 8.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Jul 14, 2026
High 7.0

CVE-2026-50526

.NET Tampering Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026
Medium 6.5

CVE-2026-50659

.NET Spoofing Vulnerability

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Jul 14, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2499217
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500109
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500189
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500492
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500502
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500509
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500515
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500556
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500562
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500563
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500565
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500577
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500581
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500587
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500589
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500593
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41895.json
report
https://access.redhat.com/security/cve/CVE-2026-47300
advisory
https://www.cve.org/CVERecord?id=CVE-2026-47300
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47300
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300
report
https://access.redhat.com/security/cve/CVE-2026-47302
advisory
https://www.cve.org/CVERecord?id=CVE-2026-47302
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47302
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302
report
https://access.redhat.com/security/cve/CVE-2026-47303
advisory
https://www.cve.org/CVERecord?id=CVE-2026-47303
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47303
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303
report
https://access.redhat.com/security/cve/CVE-2026-47304
advisory
https://www.cve.org/CVERecord?id=CVE-2026-47304
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47304
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304
report
https://access.redhat.com/security/cve/CVE-2026-50524
advisory
https://www.cve.org/CVERecord?id=CVE-2026-50524
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-50524
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524
report
https://access.redhat.com/security/cve/CVE-2026-50525

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Fixed packages 21

Vulnerabilities 17

ASP.NET Core Elevation of Privilege Vulnerability

ASP.NET Core Elevation of Privilege Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Framework Remote Code Execution Vulnerability

.NET Remote Code Execution Vulnerability

.NET Framework Elevation of Privilege Vulnerability

.NET Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability

.NET Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Tampering Vulnerability

.NET Spoofing Vulnerability

References