ALSA-2026:86172

[ALSA-2026:86172] Critical: .NET 9.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 9.0.122  
Runtime version: 9.0.21  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-runtime-9.0-9.0.21-1.el10_2.aarch64.rpm	10bce3b0634e344ef85851c73db43b93cbdd77698d33d6d260cd166845bd3916
aarch64	dotnet-apphost-pack-9.0-9.0.21-1.el10_2.aarch64.rpm	5276623c82543c43fad5e692368791f6db0e35997d89bafe506983e6f2620827
aarch64	dotnet-templates-9.0-9.0.122-1.el10_2.aarch64.rpm	8a0273613711b91e8616a36d6934bb85e51e9c8e1e7919a4e6a01afb41a40e05
aarch64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.aarch64.rpm	8c62a5c689f0f3ade7321c7899041235c68a3aaa1db576158d44c0950d550310
aarch64	aspnetcore-runtime-9.0-9.0.21-1.el10_2.aarch64.rpm	8d9299379e985dbfd4de1045af7da2fc24f3ec627b39fd3487d72711911502a3
aarch64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2.aarch64.rpm	9c727b59ad7baef8fbd8e1a44cf818f1490fed2b2d10a1f1b3d9b539ac6434b3
aarch64	dotnet-sdk-9.0-9.0.122-1.el10_2.aarch64.rpm	afa9752570a0046ebcc007e12d3c9fb257741f9411ea111625ddaee27ea962b7
aarch64	dotnet-targeting-pack-9.0-9.0.21-1.el10_2.aarch64.rpm	b605308f1bf4873e48d082567070fd70b0318b18842093ab639fabc323874463
aarch64	dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.aarch64.rpm	b703a34cf988ebf4b3c8c462ae65da10f54f17db1fc382d6165921ffb4b39f51
aarch64	netstandard-targeting-pack-2.1-9.0.122-1.el10_2.aarch64.rpm	dd20d52b140ff1bafe7dd51610b15f0cca349f3d54a6a29bafecd83eba5435db
aarch64	dotnet-sdk-aot-9.0-9.0.122-1.el10_2.aarch64.rpm	eb4ec04277072c34b3f61424a098ae31445567f7490e746d28d7cc25e307995c
aarch64	dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.aarch64.rpm	ed2f857896ef5b4f8fee7d140ac51e2604864d699a8b4b10e8f54b4554447a66
aarch64	aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.aarch64.rpm	f232d1a5ed6b34c8309b3366ead85b670ff9e9e53324266db69f19a582125e86
aarch64	dotnet-hostfxr-9.0-9.0.21-1.el10_2.aarch64.rpm	f62e6de3295668fcb140b5ef98e9105e07ac09a73bf1e12618f51baefcd1b441
ppc64le	dotnet-hostfxr-9.0-9.0.21-1.el10_2.ppc64le.rpm	3b93dbd819c72e6ffee3d4e8a415e7bdedf62abebf234bd4694221ee8a711f5c
ppc64le	dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.ppc64le.rpm	437d77eb766d4b022e012add9f73ab0038266d7f9b66b387d398220d9fd670d9
ppc64le	dotnet-targeting-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm	4b53906e047e606e04b0e0c5263cbb251373de2a163d4f56e13022773f0e9856
ppc64le	dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.ppc64le.rpm	5960b44ba7403447a1e24bcabb84a495c962f41b34d8b9a05019e318f13d25aa
ppc64le	dotnet-apphost-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm	60a18f1b7508ad1797e39eae039fc68668296521c84be12f28ab92412c8314ef
ppc64le	dotnet-runtime-9.0-9.0.21-1.el10_2.ppc64le.rpm	7dc46ea7e4effeb1c6294e589f9f11bae067d49fc042317a06423171c22de2bf
ppc64le	dotnet-templates-9.0-9.0.122-1.el10_2.ppc64le.rpm	927451603cad80320b565d3029f3fa6ceceb87f6b73a79666935ced86f8a86eb
ppc64le	aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.ppc64le.rpm	968044290577077337b2c8330e64fbd4b1d0641e3e78dc86d030d468307b92cb
ppc64le	netstandard-targeting-pack-2.1-9.0.122-1.el10_2.ppc64le.rpm	ae2d990c158d3f51e3b620c67f0683a5a5692d73e2a1047ef47c23cdf8336169
ppc64le	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2.ppc64le.rpm	b1eecb3931d8e6e3df977999e66f9b2d7afcbc0214989c21cb70c92eb046206b
ppc64le	aspnetcore-runtime-9.0-9.0.21-1.el10_2.ppc64le.rpm	b297b3519ac95adf24843372e5dc344553050b080433f608cad17c8dce63cb57
ppc64le	aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm	eb801aed695cab06932a09234e20cf05fcc0d810288e449c6b49f730d2f4b389
ppc64le	dotnet-sdk-9.0-9.0.122-1.el10_2.ppc64le.rpm	f02a9e5cd80e6d8ac1959682ea6678554da9156be5e85761a1e8f7b64da8cda0
s390x	dotnet-sdk-9.0-9.0.122-1.el10_2.s390x.rpm	0a4a4c1187e5a706514710c843a29ca4363f80354f9401a0c139cd254f7fb97f
s390x	dotnet-targeting-pack-9.0-9.0.21-1.el10_2.s390x.rpm	25adeab25cee516f7a802c49a34c4a1645b50fd4fbc7c18d9a6d09962d7dbfcc
s390x	aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.s390x.rpm	2c06433865e2c5f4ba260fabf3a624e22928ead316b52ed364fdecfb14f150a9
s390x	aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.s390x.rpm	38415481fa02d08f45de33cad566468660436aaa15cdda9d798d8b4a6c98a2e7
s390x	dotnet-apphost-pack-9.0-9.0.21-1.el10_2.s390x.rpm	5993eb045bd37d1246293fadaa0479dee9a649e13f5f54f39d2a5a40198c4431
s390x	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2.s390x.rpm	5d10f8a611137fc3eab46e86a22612a76be8e3d90c9195d9c8e993cf71860665
s390x	aspnetcore-runtime-9.0-9.0.21-1.el10_2.s390x.rpm	7da77bd17da2a1691554852447ad3b9ed001ba16f1d790cb8dcc479db4389a5b
s390x	dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.s390x.rpm	83abba31260b1f82b387455a6b3bc908f32a89ada377d8fa04d72036548f64e0
s390x	netstandard-targeting-pack-2.1-9.0.122-1.el10_2.s390x.rpm	ce93d21bd723d0ef7a9eddccadb6dc1251132eecd3f4c31ac2f2bd68d351f3e7
s390x	dotnet-runtime-9.0-9.0.21-1.el10_2.s390x.rpm	d2714250a843ae6100da82c65a65ad7b975fab6429f5ebb8962ba6b0af9beddb
s390x	dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.s390x.rpm	d2baf83bca194fffce24184614edbe91e477c0e5cd97bd7314430814088fd219
s390x	dotnet-templates-9.0-9.0.122-1.el10_2.s390x.rpm	e601de67d6a89153d1f7d77015249a5dadc7db24a6f2c2c509b8d7c946bbdc61
s390x	dotnet-hostfxr-9.0-9.0.21-1.el10_2.s390x.rpm	fc8ee5f10e663ffe682324da1f742f49d37e17b427163ab919b9bc724ac5a9c0
x86_64	dotnet-hostfxr-9.0-9.0.21-1.el10_2.x86_64.rpm	263a6cd681f18a16b56e224067851fdcf1ea1db347c2239992d7c76301d6e148
x86_64	dotnet-sdk-aot-9.0-9.0.122-1.el10_2.x86_64.rpm	2ab1f646270f4e0edf5d5838005d76638b20a993be9c234ac9779943a97bcb31
x86_64	dotnet-apphost-pack-9.0-9.0.21-1.el10_2.x86_64.rpm	2ff6b0d70b8d1af14aec253b95ae9a4d4cc13ef37acd3f37a085ce7aa638479a
x86_64	aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.x86_64.rpm	34c46d7d546db915dd2f6b286d85fb3583d93a61fb38cbba07973adeaf6fbc8b
x86_64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2.x86_64.rpm	424d5a860ba2e9ac986bb46200357be73d01a759cffce2428169770a9ba33b4d
x86_64	dotnet-sdk-9.0-9.0.122-1.el10_2.x86_64.rpm	4530d1d2918d0827eb3c000067cace12e71ca44a359c7073c69815fe0942bf57
x86_64	dotnet-runtime-9.0-9.0.21-1.el10_2.x86_64.rpm	4ce832d025c1bcd8216fe8a0ab88c43eb30ee4a4305afb9aa9fcc8024b7a47e2
x86_64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64.rpm	808a7959144a68de56a97978d4b07795e83f87fcc20bb9782e351881e2400d87
x86_64	netstandard-targeting-pack-2.1-9.0.122-1.el10_2.x86_64.rpm	b754605f5b6862bb3b7f3037766b6f49b4bbd34711f4bc29e97aaa56887d91e4
x86_64	dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.x86_64.rpm	c5858c555318fbc99525ee87c7925369d1ead0006431df895dc7dc9e79ef429c
x86_64	dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64.rpm	c5c7b6c4777f749823d0ef02fb886ef1d5ffa6c8da3c245550db133cbce31494
x86_64	aspnetcore-runtime-9.0-9.0.21-1.el10_2.x86_64.rpm	cd500ae2a4ead92f026a9dc56178bb27df2aea73d83919a89c66d4489d0d4d37
x86_64	dotnet-targeting-pack-9.0-9.0.21-1.el10_2.x86_64.rpm	d46b313fc50f8d315a359689780ab98f39d0c6e48fa3e0ffaeb3eb20c5955b32
x86_64	dotnet-templates-9.0-9.0.122-1.el10_2.x86_64.rpm	db30cb8bbcc001bdd4a26fecf46354862b959f3cc7115fdfaedbf1983f951ff8
x86_64_v2	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2.x86_64_v2.rpm	1821fcf247fda3a42efd5bf3446d12a54f1a5bbd148c3e2103f6b7973f0af624
x86_64_v2	dotnet-sdk-aot-9.0-9.0.122-1.el10_2.x86_64_v2.rpm	25559ef30b9370cb0f3a6c85559eac183ed06ab589d4779215276573bc3e0192
x86_64_v2	dotnet-apphost-pack-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	30062e6b144a6eb6d8be9e79fc22284b0b549a311a9eaebc9a721a1bea7afa36
x86_64_v2	dotnet-runtime-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	4a5d7cf5e70c7ffdcd1596f7af8fe12f0a12dab6c6bf478f077f9cfc17203b7c
x86_64_v2	dotnet-templates-9.0-9.0.122-1.el10_2.x86_64_v2.rpm	738666972dee91f72fbffddb372c24ae7b52df59cacf1036a3601f5893a75fbf
x86_64_v2	aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	817633c1f1ed93e0df951822810eedc832fb94c79e18bb25d8380782f30630be
x86_64_v2	dotnet-sdk-9.0-9.0.122-1.el10_2.x86_64_v2.rpm	9b234df4536998ff70968551cbff3e50f04ef27b53846e9e9227e5360a55473d
x86_64_v2	dotnet-targeting-pack-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	9ed1d6adf1ecbd1584948539633ef0c5855816e5ea0b0c0b436f27b8f8ba8402
x86_64_v2	dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.x86_64_v2.rpm	a38f1a3f39e3d1e6094f1a2a790033c50f97669139fda8678637643c3bcb7662
x86_64_v2	dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	a996eff8afba5ee28d339beadab46d838b1a746caeb94bc0628f2c0fe2468644
x86_64_v2	aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	c611be825a537d35e33efac852685f072e1732c47d261b2c685ee8cba9f55852
x86_64_v2	netstandard-targeting-pack-2.1-9.0.122-1.el10_2.x86_64_v2.rpm	e9ccf340b7eeaf07574e0886986fd64df7b81edce75d06de3402a00cd982e526
x86_64_v2	aspnetcore-runtime-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	efcbcdfc51717d8aca06d90908cc4474d5fa42c6811d43db207eb11e59339d75
x86_64_v2	dotnet-hostfxr-9.0-9.0.21-1.el10_2.x86_64_v2.rpm	f23abeb3fe46dc4bef448d188f3937be74ef164d82ebe472781810cabd1b020b

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.