RHSA-2026:89735 — Red Hat Security Advisory: .NET 9.0 security update

Fixed packages 32

Release	Package	Fixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	aspnetcore-runtime-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	aspnetcore-runtime-dbg-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	aspnetcore-targeting-pack-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-apphost-pack-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-apphost-pack-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-host	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-host-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-hostfxr-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-hostfxr-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-runtime-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-runtime-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-runtime-dbg-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-sdk-9.0	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-sdk-9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-sdk-aot-9.0	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-sdk-aot-9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-sdk-dbg-9.0	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-targeting-pack-9.0	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet-templates-9.0	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet9.0	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	dotnet9.0-debugsource	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	netstandard-targeting-pack-2.1	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-apphost-pack-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-host-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-hostfxr-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-runtime-9.0-debuginfo	0:9.0.21-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-sdk-9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-sdk-9.0-source-built-artifacts	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet-sdk-aot-9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet9.0-debuginfo	0:9.0.122-1.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	dotnet9.0-debugsource	0:9.0.122-1.el9_6

Vulnerabilities 26

Critical 9.4

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
Critical 9.1

CVE-2026-70188

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 8.8

CVE-2026-96230 Public exploit

ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft.AspNetCore.Components.WebAssembly.Server Ubuntu Alpine NuGet

Oct 13, 2026
High 8.1

CVE-2026-70175

ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 .NET 11.0 installed on Windows Linux Windows macOS Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.8

CVE-2026-96225

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.8

CVE-2026-96231

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-58280

.NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-69651

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-70159

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft.AspNetCore.SignalR.Core Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-70179

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft.AspNetCore.Authentication.Negotiate Ubuntu Alpine NuGet

Oct 13, 2026
High 7.5

CVE-2026-70181

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-70183

ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-70186

ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-84008

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-96233

ASP.NET Core Denial of Service Vulnerability

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-96236

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-96237

.NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine

Oct 13, 2026
High 7.5

CVE-2026-96958

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-96959

.NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.5

CVE-2026-96960

.NET Denial of Service Vulnerability

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
High 7.0

CVE-2026-69806

.NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine

Sep 8, 2026
Medium 6.5

CVE-2026-58649

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine

Sep 8, 2026
Medium 6.5

CVE-2026-96238

.NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine

Oct 13, 2026
Medium 5.9

CVE-2026-66822

.NET Information Disclosure Vulnerability

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
Medium 5.9

CVE-2026-70196

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026
Medium 5.3

CVE-2026-92707

MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] …

MessagePack-CSharp MessagePack-CSharp dotnet7 dotnet8-runtime Ubuntu Azure Linux Alpine NuGet

Oct 15, 2026

References

article
https://access.redhat.com/security/updates/classification/#critical
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528870
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528921
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548778
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548781
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548784
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548786
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548787
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548790
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548791
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548792
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548793
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548796
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548798
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548799
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548800
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548803
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548804
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548805
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548806
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548807
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548808
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548809
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89735.json
report
https://access.redhat.com/security/cve/CVE-2026-58280
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58280
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58280
report
https://access.redhat.com/security/cve/CVE-2026-58649
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58649
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58649
report
https://access.redhat.com/security/cve/CVE-2026-66822
advisory
https://www.cve.org/CVERecord?id=CVE-2026-66822
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-66822
report
https://access.redhat.com/security/cve/CVE-2026-69651
advisory
https://www.cve.org/CVERecord?id=CVE-2026-69651
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-69651
report
https://access.redhat.com/security/cve/CVE-2026-69806
advisory
https://www.cve.org/CVERecord?id=CVE-2026-69806
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-69806

Red Hat Security Advisory: .NET 9.0 security update

Fixed packages 32

Vulnerabilities 26

ASP.NET Core Tampering Vulnerability

ASP.NET Core Security Feature Bypass Vulnerability

ASP.NET Core Remote Code Execution Vulnerability

ASP.NET Core Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

ASP.NET Core Elevation of Privilege Vulnerability

ASP.NET Core Denial of Service Vulnerability

ASP.NET Core Elevation of Privilege Vulnerability

ASP.NET Core Denial of Service Vulnerability

.NET Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

.NET Remote Code Execution Vulnerability

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Elevation of Privilege Vulnerability

.NET Information Disclosure Vulnerability

.NET Security Feature Bypass Vulnerability

.NET Information Disclosure Vulnerability

ASP.NET Core Denial of Service Vulnerability

MessagePack: Nested arrays can blow past buffer length limits

References