Summary
Multiple security issues were discovered in .NET and this update includes
new upstream .NET versions to fix these issues.
.NET 8 has been updated to 8.0.34 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
.NET 10 has been updated to 10.0.15 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS
and Ubuntu 26.10. .NET 11 has been updated to 11.0.0 in Ubuntu 26.10.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.134-8.0.34-0ubuntu1~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet10 | 10.0.115-10.0.15-0ubuntu1~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet8 | 8.0.134-8.0.34-0ubuntu1~24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | dotnet10 | 10.0.115-10.0.15-0ubuntu1~26.04.1 |
| Ubuntu · 26.10 | dotnet10 | 10.0.115-10.0.15-0ubuntu1~26.10.1 |
| Ubuntu · 26.10 | dotnet11 | 11.0.100-11.0.0-0ubuntu1~26.10.1 |
Vulnerabilities 15
-
Critical 9.0
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
.NET Elevation of Privilege Vulnerability
Improper access control in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
.NET Denial of Service Vulnerability
Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
Medium 6.8
.NET Security Feature Bypass Vulnerability
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 6.5
ASP.NET Core Security Feature Bypass Vulnerability
Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 6.1
ASP.NET Core Information Disclosure Vulnerability
Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
ASP.NET Core Information Disclosure Vulnerability
Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
-
Medium 5.3
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
References
-
report
https://ubuntu.com/security/CVE-2026-105544
-
report
https://ubuntu.com/security/CVE-2026-109475
-
report
https://ubuntu.com/security/CVE-2026-109476
-
report
https://ubuntu.com/security/CVE-2026-109478
-
report
https://ubuntu.com/security/CVE-2026-109481
-
report
https://ubuntu.com/security/CVE-2026-114146
-
report
https://ubuntu.com/security/CVE-2026-114147
-
report
https://ubuntu.com/security/CVE-2026-114149
-
report
https://ubuntu.com/security/CVE-2026-114150
-
report
https://ubuntu.com/security/CVE-2026-114155
-
report
https://ubuntu.com/security/CVE-2026-114156
-
report
https://ubuntu.com/security/CVE-2026-118746
-
report
https://ubuntu.com/security/CVE-2026-118748
-
report
https://ubuntu.com/security/CVE-2026-118749
-
report
https://ubuntu.com/security/CVE-2026-120796