Summary
Kevin Jones discovered that the System.Security.Cryptography.Cose component
in .NET did not properly handle certain missing special elements in input
data. An attacker could possibly use this issue to bypass security checks
and gain unauthorized access or perform data manipulation.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.124-8.0.24-0ubuntu1~22.04.1 |
| Ubuntu · 25.10 | dotnet10 | 10.0.103-10.0.3-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet8 | 8.0.124-8.0.24-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet9 | 9.0.114-9.0.13-0ubuntu1~25.10.1 |
Vulnerabilities 1
-
High 7.5
.NET Spoofing Vulnerability
Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
References
-
report
https://ubuntu.com/security/CVE-2026-21218