ALSA-2026:86168

[ALSA-2026:86168] Critical: .NET 8.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 8.0.132  
Runtime version: 8.0.32  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-sdk-8.0-8.0.132-1.el10_2.aarch64.rpm	229dbe520afd2eb77c5fd7a7ab484631cbe603df903a52da3644a0fa715d0814
aarch64	dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2.aarch64.rpm	564415f13c97af938dfcdab7e376d6156dfb8598f10739ffe7d847ba365f9895
aarch64	dotnet-templates-8.0-8.0.132-1.el10_2.aarch64.rpm	695d6096a4bdd7255e7c09f0e03d949fd683527888575c72f8eb3ff1821d8867
aarch64	dotnet-apphost-pack-8.0-8.0.32-1.el10_2.aarch64.rpm	74183abf9b0d0288354a133cbeeff371246179105b1ee64debb1379995a02463
aarch64	dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.aarch64.rpm	78328db6724e8aa740fdd75f06f7d25c1da606e467357118753969cb133ae5cf
aarch64	dotnet-targeting-pack-8.0-8.0.32-1.el10_2.aarch64.rpm	79d5550767d141af78c7f6c2108d101bd95841b34e4ad84c672fc471fcb90ea4
aarch64	aspnetcore-runtime-8.0-8.0.32-1.el10_2.aarch64.rpm	93ee0e2a4732b652fc1322e4a10caa4210798a79a3cc169549a652a7e625251c
aarch64	dotnet-hostfxr-8.0-8.0.32-1.el10_2.aarch64.rpm	aa36392508f949df66d4cf039a8aa86a9f1876c084aea9ded102afa726d513b1
aarch64	aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.aarch64.rpm	aff6c594ae5a7c27a1763c26ab67fc97f4480d9b7beb5b2a330fc722d56a7903
aarch64	dotnet-runtime-8.0-8.0.32-1.el10_2.aarch64.rpm	c5ba92b42b13af101beede9dac95581c316aa7f3f32b95dfe843932dea49501c
aarch64	dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.aarch64.rpm	cfb4d33ef73554e63ff4042b5eb0b4695dc3e880a618957efec31da59c68b69d
aarch64	aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.aarch64.rpm	d51acda9be88b9962d2d1eb7d35f28c8d880c090b8b29e491fed7dc8415a1cdf
ppc64le	dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2.ppc64le.rpm	1715bbbb478b2b92d10da7a8b4cca10ae718a5510a1aa4e668112595f49282cf
ppc64le	dotnet-hostfxr-8.0-8.0.32-1.el10_2.ppc64le.rpm	4340a9599f2703c34fe927de8a20cccaa93a5ee265f0e3522a6c27ec9ba8a6b3
ppc64le	aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm	478321798bd17a05d5d16fc2ebdf5db9c8b2586aecc5317dc436835d4d3d6f11
ppc64le	dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.ppc64le.rpm	50a499e73be559673f353f0727bcf67b998f8d2a62889f4305e31172d01feb71
ppc64le	aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.ppc64le.rpm	80375766b84e92ec5fcb390892ea05ed6a995e2e7d7b5e0e084a73fd198e5bdf
ppc64le	aspnetcore-runtime-8.0-8.0.32-1.el10_2.ppc64le.rpm	83b9ece34612919dacdd9c11a430debfae884bd68410fc8d6a214b3a36910ba7
ppc64le	dotnet-runtime-8.0-8.0.32-1.el10_2.ppc64le.rpm	8984dfc83737fec3d0bc61db80a284a646584107514bd25d5fdd65ae98cb8b7d
ppc64le	dotnet-templates-8.0-8.0.132-1.el10_2.ppc64le.rpm	aa84e225a86e11a1d843a19fd3159ef5cd8a76b3f3dfa12d46d01f7335d6e88d
ppc64le	dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.ppc64le.rpm	d06d71c35715ffb9d4aff36ff049bd9b9d1915d99b69ef7c16b65ab7411b43ac
ppc64le	dotnet-apphost-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm	e87e96b240d55401f163e0879935dcdbf7d8f42d1391249d638c9ebcffa1b955
ppc64le	dotnet-sdk-8.0-8.0.132-1.el10_2.ppc64le.rpm	f21fcc9f7fa0c5be10226960c750580dd5f56eebc33292ae48d069b6c5f3c224
ppc64le	dotnet-targeting-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm	f6ba7fe7c4e3036bfe3892bd928a2628d3badf55a74cc673dadeebd0fde1bc52
s390x	dotnet-targeting-pack-8.0-8.0.32-1.el10_2.s390x.rpm	2dc1b3a469cd13767099db6217d22b54cb627441f2198e6451b557466ef93ea5
s390x	aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.s390x.rpm	3428dc7c36f2cdfd451790e414ea191486ae9a1ed1904d52936f89c4965160da
s390x	aspnetcore-runtime-8.0-8.0.32-1.el10_2.s390x.rpm	380d0604dc261df322c05e1a5d9645c8f080e0fabfaf8809cfe61ca42d11f30b
s390x	dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.s390x.rpm	5808f21e11bfb58ab354b015232ff141e6dbe9130adbd19e7f5abae5b237bfa3
s390x	dotnet-sdk-8.0-8.0.132-1.el10_2.s390x.rpm	5a6bb10ebe3d621939d53a3720f2e00fc9a532104d76112ec96224feddbd8ffa
s390x	dotnet-runtime-8.0-8.0.32-1.el10_2.s390x.rpm	5e0edd8234302b0af2c1219eefb4eccf7376fdf9acf2117c019b3c20c0185e37
s390x	dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2.s390x.rpm	5f58de59d9c14f9a4f1f92a5ff145e41dfa1de6ffa082bdc1c70e3d8e295c381
s390x	dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.s390x.rpm	6e6af54468923d8754bad816bd1e5b5531a042cc0576c55f69874e98b5d86a81
s390x	aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.s390x.rpm	ab48de8f2d0382c41749e859a1c2dea3094877e32d6d1cd56c3e0c7d45ea5741
s390x	dotnet-hostfxr-8.0-8.0.32-1.el10_2.s390x.rpm	c55e16f8de86dfe11f8f1457357571697e8477be99f0ad13f3cce836b54e17d0
s390x	dotnet-templates-8.0-8.0.132-1.el10_2.s390x.rpm	e51e8649eabae0d1900a90599d018b3edc6100f092cd17628d9dc6d3eace56f0
s390x	dotnet-apphost-pack-8.0-8.0.32-1.el10_2.s390x.rpm	f6a64b8e08432908afac5fc97dc8d6636a53fe4ed62c465ffc7e92acc9f4cede
x86_64	dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64.rpm	152b4b17cb520d2760fc8cae56475e16fbd29b0dff7c0701be7b1d0c4b982b87
x86_64	dotnet-targeting-pack-8.0-8.0.32-1.el10_2.x86_64.rpm	18a82ad8e11790262bb2592f693e83d19d114c38632aadb73ce7fabe32b34f04
x86_64	dotnet-apphost-pack-8.0-8.0.32-1.el10_2.x86_64.rpm	221cdd3bd73e5b74b5d9311eace10553abdcdbe909bc3e7ef453d44e96bc2f8e
x86_64	dotnet-runtime-8.0-8.0.32-1.el10_2.x86_64.rpm	3f13929e93d1457dd57bb4cf826c5ac1c6d3aafcc8d7181c12fe4f3bfbfaa12d
x86_64	dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.x86_64.rpm	5329a178d1118d666f77a874eb294e2ebab88bcf835556c1fead43bdb4aa1932
x86_64	dotnet-hostfxr-8.0-8.0.32-1.el10_2.x86_64.rpm	6057e63f298ea6a049d9dfb7c52791f3a91d17b23ebd36b260e66cccad71214c
x86_64	aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.x86_64.rpm	6ce84a578b93d138019ee9815adb022613c3e1bbf818bab4dabe85b3fd902517
x86_64	dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2.x86_64.rpm	81e25975f04e4be43691b6144e2b68452d92d1a6185d9591203fddcb1738df2a
x86_64	aspnetcore-runtime-8.0-8.0.32-1.el10_2.x86_64.rpm	b00cdfe3bae3fb4eee30aa3da638d50923a8398bf82ad3e422ae18695120089d
x86_64	dotnet-sdk-8.0-8.0.132-1.el10_2.x86_64.rpm	beb56643cc958969e2546032fbe96a8f7fda7925bb144af5b897d8284b4bddd1
x86_64	dotnet-templates-8.0-8.0.132-1.el10_2.x86_64.rpm	c940e253b7989b85bf34a6c2b3eee93ce891b050107c2bc6b4ee7e362db7cb5a
x86_64	aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64.rpm	e0ceedcd4e739e9649b041425e4b961d269a21c5c2927467d61d352915df7fcc
x86_64_v2	aspnetcore-runtime-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	3cd0e29b44d9e1f975b71ca42924c645bca6a5929cb42d418223a26136669155
x86_64_v2	dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.x86_64_v2.rpm	3eba9a37880636f9b5fe8307d8481c9ffb61cb101832c28f2aa277db6d811b30
x86_64_v2	aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	4c45f3c23ce34b100962dc31f8e003c51a8526c90ec25fe12e8f5cef09b6ffe7
x86_64_v2	dotnet-sdk-8.0-8.0.132-1.el10_2.x86_64_v2.rpm	6f85d1c95000b1a07e90d62b047d872298e2bf57a410300d8eb22f444e60413d
x86_64_v2	dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2.x86_64_v2.rpm	738607a2084ca6d7c872dc03aa17732100e61a81c6123fd6ccf6889bbc407cb3
x86_64_v2	aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	756c95e3535fbde93ba71a0b1291f87d8a20c75605ac9dfcac273ea0c7948fd0
x86_64_v2	dotnet-targeting-pack-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	804945cdf9902b1c4dd866f5997530da1d7e459a46e7fb3a99e15e7541cdb262
x86_64_v2	dotnet-templates-8.0-8.0.132-1.el10_2.x86_64_v2.rpm	b1ced9f64bdfa00a032cd545fdc0fbbfefdf77adadb4d6c84f1facb643ec652b
x86_64_v2	dotnet-hostfxr-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	cf4b5f506f68c1bd4976fc0809760a3f340705bc6ac0e254bf6aad468be533fd
x86_64_v2	dotnet-apphost-pack-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	d26a4be11c296243cda8a39694344549c5d0886f5211f5dcf74f623da5aeaf11
x86_64_v2	dotnet-runtime-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	e7bea0c7cef6672a8edf2c8f036acfecef6361c232185809c95bcba7b41ce88c
x86_64_v2	dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.x86_64_v2.rpm	f0d2b32e467486193d518a56288dfb4fafb5442b1ed7445c300d7088c406cead

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.