Summary
It was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not
properly handle certain malformed Base64Url encoded input. An attacker could
possibly use this issue to cause .NET to crash, resulting in a denial of
service. This issue only affected .NET 9.0 and .NET 10.0. (CVE-2026-26127)
Bartłomiej Dach discovered that .NET's SignalR server component did not
properly manage resource consumption when processing certain messages. An
attacker could possibly use this issue to exhaust internal buffers, resulting
in a denial of service. (CVE-2026-26130)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.125-8.0.25-0ubuntu1~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet10 | 10.0.104-10.0.4-0ubuntu1~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet8 | 8.0.125-8.0.25-0ubuntu1~24.04.1 |
| Ubuntu · 25.10 | dotnet10 | 10.0.104-10.0.4-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet8 | 8.0.125-8.0.25-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet9 | 9.0.115-9.0.14-0ubuntu1~25.10.1 |