Skip to content
OpenAdvisories

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products

VendorProductAffectedFixed
Microsoft .NET 10.0 runtime 10.0.0 – < 10.0.10 10.0.10
Microsoft .NET 8.0 runtime 8.0.0 – < 8.0.29 8.0.29
Microsoft .NET 9.0 runtime 9.0.0 – < 9.0.18 9.0.18

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 dotnet10 10.0.107-10.0.7-0ubuntu1~26.04.1 —
Ubuntu 26.04 LTS dotnet10 10.0.107-10.0.7-0ubuntu1~26.04.1 —
Ubuntu 25.10 dotnet10 10.0.106-10.0.6-0ubuntu1~25.10.1 —
Ubuntu 25.10 dotnet8 8.0.126-8.0.26-0ubuntu1~25.10.1 —
Ubuntu 25.10 dotnet9 9.0.115-9.0.14-0ubuntu1~25.10.1 —
Ubuntu 24.04 LTS dotnet10 10.0.106-10.0.6-0ubuntu1~24.04.1 —
Ubuntu 24.04 LTS dotnet8 8.0.126-8.0.26-0ubuntu1~24.04.1 —
Ubuntu 22.04 LTS dotnet6 +1 No fix yet —
Ubuntu 22.04 LTS dotnet8 8.0.126-8.0.26-0ubuntu1~22.04.1 —
ReleasePackageFixed inAdvisory
RHEL 10 dotnet-host +8 10.0.10-1.el10_2 RHSA-2026:41897
RHEL 10 dotnet-hostfxr-8.0 +7 8.0.29-1.el10_2 RHSA-2026:41893
RHEL 10 dotnet-hostfxr-9.0 +7 9.0.18-1.el10_2 RHSA-2026:41895
RHEL 10 dotnet10.0 +5 10.0.110-1.el10_2 RHSA-2026:41897
RHEL 10 dotnet8.0 +4 8.0.129-1.el10_2 RHSA-2026:41893
RHEL 10 dotnet9.0 +6 9.0.119-1.el10_2 RHSA-2026:41895
RHEL 9 dotnet-host +8 10.0.10-1.el9_8 RHSA-2026:41898
RHEL 9 dotnet-hostfxr-8.0 +7 8.0.29-1.el9_8 RHSA-2026:41894
RHEL 9 dotnet-hostfxr-9.0 +7 9.0.18-1.el9_8 RHSA-2026:41896
RHEL 9 dotnet10.0 +5 10.0.110-1.el9_8 RHSA-2026:41898
RHEL 9 dotnet8.0 +4 8.0.129-1.el9_8 RHSA-2026:41894
RHEL 9 dotnet9.0 +6 9.0.119-1.el9_8 RHSA-2026:41896
RHEL 8 dotnet +6 10.0.110-1.el8_10 RHSA-2026:41900
RHEL 8 dotnet-host +8 10.0.10-1.el8_10 RHSA-2026:41900
RHEL 8 dotnet-hostfxr-8.0 +7 8.0.29-1.el8_10 RHSA-2026:41901
RHEL 8 dotnet-hostfxr-9.0 +7 9.0.18-1.el8_10 RHSA-2026:41899
RHEL 8 dotnet8.0 +4 8.0.129-1.el8_10 RHSA-2026:41901
RHEL 8 dotnet9.0 +6 9.0.119-1.el8_10 RHSA-2026:41899
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS dotnet-host +8 9.0.19-1.el10_0 RHSA-2026:58567
RHEL 10.0 EUS dotnet-hostfxr-8.0 +7 8.0.30-1.el10_0 RHSA-2026:58566
RHEL 10.0 EUS dotnet8.0 +4 8.0.130-1.el10_0 RHSA-2026:58566
RHEL 10.0 EUS dotnet9.0 +6 9.0.120-1.el10_0 RHSA-2026:58567
RHEL 9.6 EUS dotnet-host +8 9.0.19-1.el9_6 RHSA-2026:58570
RHEL 9.6 EUS dotnet-hostfxr-8.0 +7 8.0.30-1.el9_6 RHSA-2026:58569
RHEL 9.6 EUS dotnet8.0 +4 8.0.130-1.el9_6 RHSA-2026:58569
RHEL 9.6 EUS dotnet9.0 +6 9.0.120-1.el9_6 RHSA-2026:58570
RHEL 9.4 E4S dotnet-host +8 8.0.30-1.el9_4 RHSA-2026:58568
RHEL 9.4 E4S dotnet8.0 +4 8.0.130-1.el9_4 RHSA-2026:58568
Red Hat Hardened Images 1 dotnet-hostfxr-8.0 +7 8.0.29-2.1.hum1 RHSA-2026:42145
Red Hat Hardened Images 1 dotnet10.0 +5 10.0.109-1.hum1 RHSA-2026:26638
Red Hat Hardened Images 1 dotnet8.0 +4 8.0.129-2.1.hum1 RHSA-2026:42145
Red Hat Hardened Images 1 dotnet9.0 +6 9.0.119-1.hum1 RHSA-2026:39952

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 dotnet-host +8 10.0.10-1.el10_2 ALSA-2026:41897
AlmaLinux 10 dotnet-hostfxr-8.0 +7 8.0.29-1.el10_2 ALSA-2026:41893
AlmaLinux 10 dotnet-hostfxr-9.0 +7 9.0.18-1.el10_2 ALSA-2026:41895
AlmaLinux 10 dotnet-sdk-10.0 +4 10.0.110-1.el10_2 ALSA-2026:41897
AlmaLinux 10 dotnet-sdk-8.0 +3 8.0.129-1.el10_2 ALSA-2026:41893
AlmaLinux 10 dotnet-sdk-9.0 +5 9.0.119-1.el10_2 ALSA-2026:41895
AlmaLinux 9 dotnet-host +8 10.0.10-1.el9_8 ALSA-2026:41898
AlmaLinux 9 dotnet-hostfxr-8.0 +7 8.0.29-1.el9_8 ALSA-2026:41894
AlmaLinux 9 dotnet-hostfxr-9.0 +7 9.0.18-1.el9_8 ALSA-2026:41896
AlmaLinux 9 dotnet-sdk-10.0 +4 10.0.110-1.el9_8 ALSA-2026:41898
AlmaLinux 9 dotnet-sdk-8.0 +3 8.0.129-1.el9_8 ALSA-2026:41894
AlmaLinux 9 dotnet-sdk-9.0 +5 9.0.119-1.el9_8 ALSA-2026:41896
AlmaLinux 8 dotnet +5 10.0.110-1.el8_10 ALSA-2026:41900
AlmaLinux 8 dotnet-host +8 10.0.10-1.el8_10 ALSA-2026:41900
AlmaLinux 8 dotnet-hostfxr-8.0 +7 8.0.29-1.el8_10 ALSA-2026:41901
AlmaLinux 8 dotnet-hostfxr-9.0 +7 9.0.18-1.el8_10 ALSA-2026:41899
AlmaLinux 8 dotnet-sdk-8.0 +3 8.0.129-1.el8_10 ALSA-2026:41901
AlmaLinux 8 dotnet-sdk-9.0 +5 9.0.119-1.el8_10 ALSA-2026:41899

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 dotnet10.0 10.0.110-1.el10_2 RLSA-2026:41897
Rocky Linux 10 dotnet8.0 8.0.129-1.el10_2 RLSA-2026:41893
Rocky Linux 10 dotnet9.0 9.0.119-1.el10_2 RLSA-2026:41895
Rocky Linux 9 dotnet10.0 10.0.110-1.el9_8 RLSA-2026:41898
Rocky Linux 9 dotnet8.0 8.0.129-1.el9_8 RLSA-2026:41894
Rocky Linux 9 dotnet9.0 9.0.119-1.el9_8 RLSA-2026:41896
Rocky Linux 8 dotnet10.0 10.0.110-1.el8_10 RLSA-2026:41900
Rocky Linux 8 dotnet8.0 8.0.129-1.el8_10 RLSA-2026:41901
Rocky Linux 8 dotnet9.0 9.0.119-1.el8_10 RLSA-2026:41899

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 dotnet +5 8.0.129-1.amzn2023.0.1 ALAS2023-2026-2010, ALAS2023-2026-2009
Amazon Linux 2023 dotnet-host +8 8.0.29-1.amzn2023.0.1 ALAS2023-2026-2010, ALAS2023-2026-2009
Amazon Linux 2023 dotnet-hostfxr-10.0 +7 10.0.10-1.amzn2023.0.1 ALAS2023-2026-2009
Amazon Linux 2023 dotnet-sdk-10.0 +4 10.0.110-1.amzn2023.0.1 ALAS2023-2026-2009

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 dotnet-host +8 10.0.10-1.0.1.el10_2 ELSA-2026-41897
Oracle Linux 10 dotnet-hostfxr-8.0 +7 8.0.29-1.0.1.el10_2 ELSA-2026-41893
Oracle Linux 10 dotnet-hostfxr-9.0 +7 9.0.18-1.0.1.el10_2 ELSA-2026-41895
Oracle Linux 10 dotnet-sdk-10.0 +4 10.0.110-1.0.1.el10_2 ELSA-2026-41897
Oracle Linux 10 dotnet-sdk-8.0 +3 8.0.129-1.0.1.el10_2 ELSA-2026-41893
Oracle Linux 10 dotnet-sdk-9.0 +5 9.0.119-1.0.1.el10_2 ELSA-2026-41895
Oracle Linux 9 dotnet-host +8 10.0.10-1.0.1.el9_8 ELSA-2026-41898
Oracle Linux 9 dotnet-hostfxr-8.0 +7 8.0.29-1.0.1.el9_8 ELSA-2026-41894
Oracle Linux 9 dotnet-hostfxr-9.0 +7 9.0.18-1.0.1.el9_8 ELSA-2026-41896
Oracle Linux 9 dotnet-sdk-10.0 +4 10.0.110-1.0.1.el9_8 ELSA-2026-41898
Oracle Linux 9 dotnet-sdk-8.0 +3 8.0.129-1.0.1.el9_8 ELSA-2026-41894
Oracle Linux 9 dotnet-sdk-9.0 +5 9.0.119-1.0.1.el9_8 ELSA-2026-41896
Oracle Linux 8 dotnet +5 10.0.110-1.0.1.el8_10 ELSA-2026-41900
Oracle Linux 8 dotnet-host +8 10.0.10-1.0.1.el8_10 ELSA-2026-41900
Oracle Linux 8 dotnet-hostfxr-8.0 +7 8.0.29-1.0.1.el8_10 ELSA-2026-41901
Oracle Linux 8 dotnet-hostfxr-9.0 +7 9.0.18-1.0.1.el8_10 ELSA-2026-41899
Oracle Linux 8 dotnet-sdk-8.0 +3 8.0.129-1.0.1.el8_10 ELSA-2026-41901
Oracle Linux 8 dotnet-sdk-9.0 +5 9.0.119-1.0.1.el8_10 ELSA-2026-41899

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 10.0.0, < 10.0.6 10.0.6 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 9.0.0, < 9.0.15 9.0.15 GHSA-j8gr-8fp3-5q5h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 8.0.0, < 8.0.26 8.0.26 GHSA-j8gr-8fp3-5q5h

Advisories 49

References