[ALSA-2026:41895] Important: .NET 9.0 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-07-31
Description:
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 dotnet-sdk-9.0-9.0.119-1.el10_2.aarch64.rpm 033916cc8cf767c22f307927660c482f9bb25acb7aefffe99c701639c17331f3
aarch64 dotnet-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm 0737939c28e0999626583c652058aa2649560c6a36b45ca02c9fab18ceb5fcc5
aarch64 aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm 42905e68a2cc68dc69ac6a93531bad6563b83b3f175feaca9f37729a816dffd0
aarch64 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm 532e7c6a6a2478e686bc1c8735086962da7dcf1adc8d216f1836b113c29854b1
aarch64 dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm 539389f8dac3be553d9f834adc82a6fc4ce152f4536af9db7f4e5d9556e98a74
aarch64 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.aarch64.rpm 53c14a68dc3b6ad70110250e2d9d8b9583fc0d8de202fa433f6dbf0463c628c0
aarch64 dotnet-hostfxr-9.0-9.0.18-1.el10_2.aarch64.rpm 5b18c1131525e60522745b3ea82f1e12ee3daef85ab37648c0d74bb9b20cde91
aarch64 dotnet-sdk-aot-9.0-9.0.119-1.el10_2.aarch64.rpm 7d4f5f6f5029f229cdc7432661a445271b889ad9ab9ecc2960b82210f886d4ed
aarch64 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.aarch64.rpm 827db7d237fa6dbad077d6bf26aadecbbb082c15a54fd2d7e3cbe92bfbfd1b05
aarch64 dotnet-templates-9.0-9.0.119-1.el10_2.aarch64.rpm a42c7f9baaab8cd4423223101cca3cf71a60dfe3d45ea982d686acf5cede1223
aarch64 aspnetcore-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm aada8ece56e8172ea41aea7b84d6fbf012725561d71e9e2e174451fe0da37ccb
aarch64 dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.aarch64.rpm b2dc0227211e64021166dc71081a6cf133a72f1c9989b922eddc8e8b14027baf
aarch64 netstandard-targeting-pack-2.1-9.0.119-1.el10_2.aarch64.rpm cceadd95a35c30541ca5152a86d7a8d57993fe383714c071506ccd2ed80e41fc
aarch64 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm d658b2622da1c30347af6c3e64b5d99027fa5d9810d0579654d977c79ceb3181
ppc64le dotnet-hostfxr-9.0-9.0.18-1.el10_2.ppc64le.rpm 0ca45959645730f8fe1b5b073b0b2d8db715f682bf10b5c2ab6703e33066e10c
ppc64le netstandard-targeting-pack-2.1-9.0.119-1.el10_2.ppc64le.rpm 5e58ec656045fb30927019a5319c5e4c83d9cf52919db36552653bc84ba8c0db
ppc64le dotnet-runtime-9.0-9.0.18-1.el10_2.ppc64le.rpm 748feb033426c5aafca58b6bdf77e62877996f9453e2fa54f062f52ec66e9b5d
ppc64le aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.ppc64le.rpm 79381c98157208094f328c6133cb7cab8839d7efb7949bff5cb3024fd295c0a5
ppc64le dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.ppc64le.rpm 95bb64b7448a824b5598d173c0bb3a42a288ddbe8d53fd8389e4bd04c6ef64b4
ppc64le dotnet-apphost-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm a458aa67fbe0bcbab000dca774b3f1594f03240dedf006654273cbae3fc24a77
ppc64le dotnet-templates-9.0-9.0.119-1.el10_2.ppc64le.rpm b09c7adce494de7e5b1fafcaa07ee47b2ad04e34190ae9e74f8d9b92988d41a9
ppc64le aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm b46e3da5c04dcfff3dd293826ee51e744d47e82a4dd28a221317e3724a31dd88
ppc64le dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.ppc64le.rpm cafa639cbfb381c9c2061e739079e41ae6f4d11acd40955f79433d519339fef3
ppc64le dotnet-sdk-9.0-9.0.119-1.el10_2.ppc64le.rpm cda2ef8ab57c26884588e1668472058f911d03c84391991c7a6b8711d0280a15
ppc64le aspnetcore-runtime-9.0-9.0.18-1.el10_2.ppc64le.rpm cf948cde5f5f18f2a7e87c493975badc329ce507959926e8f39e22a4772bcef5
ppc64le dotnet-targeting-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm daf1b6d03af452cd4d641cfae9d24265a7372268bfd43fc3b3850bbbf68af6d2
ppc64le dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.ppc64le.rpm ef1849bafa6dd86f78a8dd37160b85c01b2b02aa10fed37ff2133c71a55c5b10
s390x dotnet-runtime-9.0-9.0.18-1.el10_2.s390x.rpm 09b3daf256f0789c6d0f05e87d772ed6829c8e9fb60e46d0b6c4d1072aaa76cc
s390x aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.s390x.rpm 36727f8455e62b7ca5162844f3f750971b8f44e459ce5ed635703078c836522c
s390x aspnetcore-runtime-9.0-9.0.18-1.el10_2.s390x.rpm 4f2e49f43c42ba26ff9e6723799efd03ec56d7daae688833574ff893a71d4425
s390x dotnet-targeting-pack-9.0-9.0.18-1.el10_2.s390x.rpm 5b3b9ab3d5de5050e68e8b090ed29b9b3e17eaae03b6249fb47e5b1b949b5830
s390x dotnet-hostfxr-9.0-9.0.18-1.el10_2.s390x.rpm 698bad12f036cc123c7b3d4ebb79c0df15022f0c8e2ed552b1df6aa6e95bc0c8
s390x aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.s390x.rpm 8906fa39b8b82647df6170a60d67d7647d031488530bde05f9ea3cf4c714831b
s390x dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.s390x.rpm 8f4121ced0981e812f25d48a690ac944816b1bfc75f334de829112dfba1bf9bb
s390x dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.s390x.rpm 93b1102c57aae6f8f85792f528b290b44b54c2002f32c984281db5375f293483
s390x dotnet-apphost-pack-9.0-9.0.18-1.el10_2.s390x.rpm 9ed6dfa1198cdda3ceb61dc3eab58ebc752bca3551ea11b5c857b6f161e11b17
s390x dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.s390x.rpm b5c7af3b9b03f5824a500d29f91063ee5e9198376dc9b9810c5d3312dc93a705
s390x dotnet-templates-9.0-9.0.119-1.el10_2.s390x.rpm c8bf8f69196bdc8bc53155c0fb75c3f395fe039d406ed35f543519094e4c050d
s390x netstandard-targeting-pack-2.1-9.0.119-1.el10_2.s390x.rpm db0902653fceffa126a432b4ef350d830233cad7e404dbb366e39e541476e6f0
s390x dotnet-sdk-9.0-9.0.119-1.el10_2.s390x.rpm f53ed675d59dfb50ee88e43564242b52bdb2157d82254f2ceb35ef2526307df8
x86_64 aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm 01085fad4a020a4b4d629e44ca0cc89d781b72cf21de21cac9fbaf2acf5e1d3f
x86_64 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.x86_64.rpm 16bbf3a629070bc2e6dc95ecc2ad50f45c306f199fbb2d0cba5b6f1c8be77be7
x86_64 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 1e3a27e893108bdea47b1607be7433d8dccbd4f3cdadd99fb1f5b20dd7e6b3d1
x86_64 aspnetcore-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm 26cc90930ff667e6d35bb771af3b92797dbbb33cc3982860f826ae9b580c9c44
x86_64 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 31dd9fcb03829ef924ef10ed0a0e2c24e0972037ae8f3dd1f7e9fd90589d48f5
x86_64 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.x86_64.rpm 50f132cf8c98c5bfac8edb71bdb8cbe3417a344b0d00cdafb91180798f0dc75c
x86_64 dotnet-templates-9.0-9.0.119-1.el10_2.x86_64.rpm 56f38362547fd89b5c899556930494ab829eebe99ba833e54793c34168556330
x86_64 dotnet-hostfxr-9.0-9.0.18-1.el10_2.x86_64.rpm 576e6ac08793535a6eb8fe938c15f63789a0407db9a4649fd746d4d525aff2fb
x86_64 netstandard-targeting-pack-2.1-9.0.119-1.el10_2.x86_64.rpm 7a8ded4402484ffe84e2eb760468d984ab6fc439ddceb514653b22517eec0b96
x86_64 dotnet-runtime-9.0-9.0.18-1.el10_2.x86_64.rpm 9eba22808ff26f50b25730b23dc803e542b01d6d3c5e01d22d4bc501556f79b9
x86_64 dotnet-sdk-9.0-9.0.119-1.el10_2.x86_64.rpm d198d5318bb8790cc66f16f6c7d3c12cf8d56fcff2492294533ec3f2d787168c
x86_64 dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64.rpm db511eb7c12e61e516a4c12c805de45ae44dc9c2d8f41a0badf8b2a2a1852288
x86_64 dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.x86_64.rpm e8ce053c753b84c1ae5b97317bf85f6a34cd0071172eb601790ae2aaca3e9640
x86_64 dotnet-sdk-aot-9.0-9.0.119-1.el10_2.x86_64.rpm edb5cecc64a02d37b732885b10ff8326dc6db05bf47fb4d755a2eee6fe1f0c64
x86_64_v2 dotnet-runtime-9.0-9.0.18-1.el10_2.x86_64_v2.rpm 13aaccc85931690473adf4bb9fa879162dd18741b980cac620a72aacaa9f2365
x86_64_v2 aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64_v2.rpm 3f7267ce9f18ac939e5318acf8dd763663be291984c6a6dd00823a3c8d3fa0ce
x86_64_v2 dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.x86_64_v2.rpm 4023b6bee27bc557253b6c2429bde98fc6b316e298e034e4cc4adf3d88194de6
x86_64_v2 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm 4dc358a37f0b94c683a830fc46b5e5dc6b916a8b7e7f8a5e9f4bfbce5b05860e
x86_64_v2 dotnet-sdk-aot-9.0-9.0.119-1.el10_2.x86_64_v2.rpm 555497d4082fd3cd05f9b989231092c2da2c6dd9b5a7f21df7dd3cf34cafa41d
x86_64_v2 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.x86_64_v2.rpm 80fab07174c46b8b067182cdb3b030da715e98db3725e7a1d06fcdc3c45d2951
x86_64_v2 dotnet-sdk-9.0-9.0.119-1.el10_2.x86_64_v2.rpm 8cff075bf7e9a5ab20d5e89b980abaddf111d29c07e9f3e8966e00565944a10b
x86_64_v2 dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.x86_64_v2.rpm 8db1d7370eb76ef2e0dd9c2887f5c1ee850b4fb725125a4aa3702dfdb4c9afe1
x86_64_v2 dotnet-hostfxr-9.0-9.0.18-1.el10_2.x86_64_v2.rpm bd15afcb5176243974bef3462e8c1d8433a245c9eb1d689d961ddde30790576b
x86_64_v2 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm c931bb88495e0902ec23a28b6a797dfb2796dc538dccf9bef885da602bd047b5
x86_64_v2 netstandard-targeting-pack-2.1-9.0.119-1.el10_2.x86_64_v2.rpm d2823d3af8e77d7fa262e390feaf281902397a09adf35c92407f0368d7a4eabf
x86_64_v2 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.x86_64_v2.rpm d4d62a9c87d4ff79374fa363e423bff5eaf758d5f974be0319ce2c8d6ef0d4ae
x86_64_v2 dotnet-templates-9.0-9.0.119-1.el10_2.x86_64_v2.rpm e0f088058def4db45d741d69e4e2ebaa4c040c7881dc566e91082b8d50c67e49
x86_64_v2 aspnetcore-runtime-9.0-9.0.18-1.el10_2.x86_64_v2.rpm e7d6e20b3b62d780037f3d09095080808635c6b6093ffb3395b9b7c415f9445f
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.