ALSA-2026:86195

[ALSA-2026:86195] Critical: .NET 10.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 10.0.113  
Runtime version: 10.0.13  

Security Fix(es):  

  * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
  * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-targeting-pack-10.0-10.0.13-1.el10_2.aarch64.rpm	1fb7e7dafe43d42be65c4cc1fa68ad340d1fa2748d57d55155cbcc7f713d9bca
aarch64	aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.aarch64.rpm	21541aed475b1d559b546956d5f819a3a33a56d2179538d79be7ceb70240aaaa
aarch64	dotnet-host-10.0.13-1.el10_2.aarch64.rpm	276ad91d6f3419f585f06c3323227cca306fef3377f1a6f78d13c4417b04496a
aarch64	dotnet-sdk-10.0-10.0.113-1.el10_2.aarch64.rpm	43a6a9c869c836ce4f43ef3a1dcbb8bc69f9e163b0f7a6753457a28d2e46cf59
aarch64	dotnet-runtime-10.0-10.0.13-1.el10_2.aarch64.rpm	477e048ab3456873a1856a8b5639d8d9431cbb744ea614085c3a7384254a489e
aarch64	dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.aarch64.rpm	6285822e2f2b9979fbe8536cba555b9f881345d2d1de16a7bbf47cc8220fd193
aarch64	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2.aarch64.rpm	7923da83060410d9f68605e3ea8acd91dd4097561ca6e7e3c2aa5065520cea91
aarch64	dotnet-sdk-aot-10.0-10.0.113-1.el10_2.aarch64.rpm	9522b5179b22cd7016c97f29a44123068232fc80ff51ac67d91fd2da7fec64d1
aarch64	dotnet-apphost-pack-10.0-10.0.13-1.el10_2.aarch64.rpm	abc8308ef7ca592c85fbdf3282e8bfb2a47f9dab346ba0946ef050901b563768
aarch64	aspnetcore-runtime-10.0-10.0.13-1.el10_2.aarch64.rpm	aecf2bf327da7d099a0fde710cad618846f42a28526ab8487e90d2f17207d865
aarch64	dotnet-hostfxr-10.0-10.0.13-1.el10_2.aarch64.rpm	ba79de73096eb501875cf201a44d31a5480a43d2590397d743adb61e48e9ce28
aarch64	dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.aarch64.rpm	c0b8e580fbeafe74a70cc9ee9c3f4b57822929c979cc2a75b0db50c50fa32126
aarch64	aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.aarch64.rpm	d5429a013eaeaef7288c9bb17e6af71481eba2abd1a617cefbc4f9e853fbecf8
aarch64	dotnet-templates-10.0-10.0.113-1.el10_2.aarch64.rpm	fdd8cd40605a79feccf9fbe13af2dc627889bdc512e6b00e8854355854475f00
ppc64le	aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.ppc64le.rpm	3bd378baec8d2e91f9341ec9e121b68a9dcb8aaae063fd289b68b191639e0846
ppc64le	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2.ppc64le.rpm	3cfdac249ee7b5d12d3e3ec1b98b0619af0a75ff825bc147a7035ca2e0892da3
ppc64le	aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm	5d6bf48478f4c0c4766d467ddbae93afd61f67236cdf54d34ca8659f1656d801
ppc64le	aspnetcore-runtime-10.0-10.0.13-1.el10_2.ppc64le.rpm	7009db68f59e8849d89993f04e723290718a0bcaeb50c1b3b705ae73b422f9e2
ppc64le	dotnet-host-10.0.13-1.el10_2.ppc64le.rpm	729e1e2bbb88b904d659fad17438e706940be02963ce1e80a1f26bc39435e13d
ppc64le	dotnet-hostfxr-10.0-10.0.13-1.el10_2.ppc64le.rpm	73deb4cdfc2e2933d73cc26fb3aafcbae5480412ca74ce944a6af8db4a2366a2
ppc64le	dotnet-sdk-10.0-10.0.113-1.el10_2.ppc64le.rpm	8407a723c32ef04b154f7b0660407198341a863dec3b8deed1f6b2c312ec00af
ppc64le	dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.ppc64le.rpm	9c65102a32d818d825edacdfcc7ab28403cab6f2a3c533cb03352ed432faa5c1
ppc64le	dotnet-runtime-10.0-10.0.13-1.el10_2.ppc64le.rpm	a4246d5b9734f9a422ded41d62f14ae2d76607cbd35f849793ff99d2e32f7865
ppc64le	dotnet-apphost-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm	a87103ec6d2790a0de9f8fd16b0414b8dcddad759f8e628b316e8a6e753343e0
ppc64le	dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.ppc64le.rpm	ce6845ff421c6e10ab8f3825e6f43a8aadbbac331f18efdd6491edfeff9ba231
ppc64le	dotnet-targeting-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm	d05b09027b8f7f6c3a81bd32d1f89dcf61f72e100e9afbacc63886a32cf7db81
ppc64le	dotnet-templates-10.0-10.0.113-1.el10_2.ppc64le.rpm	db3f509bda5dbd99432a0c1156a695162605ddac16cf5515695e433cc8ee5e97
s390x	dotnet-apphost-pack-10.0-10.0.13-1.el10_2.s390x.rpm	097ab821acb671d281848db993659160cde315932dd52b1bc96e67ef396880c7
s390x	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2.s390x.rpm	1708a56d4c50253cf6f53f0228654df66562e110644576369ade0ef72d14489e
s390x	dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.s390x.rpm	25206ed68cd2a4f0be134082f336bf814802adb1d6d4e047d50692fb6afae6a4
s390x	aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.s390x.rpm	46e7f421364f2f7ed3df889781a25f8b8036c00709000c217453b43df40c4e9a
s390x	dotnet-targeting-pack-10.0-10.0.13-1.el10_2.s390x.rpm	4a3bfd3bb8ee9595ac8ff1d0dabe953acdafb2cf836f2ed3e0720ef1a32d88be
s390x	aspnetcore-runtime-10.0-10.0.13-1.el10_2.s390x.rpm	4bacd1fd49ddbdef8a7fa694b8846c73b9a7f5d45f1f552a4bcb76cfa18cac42
s390x	dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.s390x.rpm	58ecaa70dccde3be6f9332233065bd70b7d296eed2af4f599c1f506a73fc29df
s390x	dotnet-sdk-10.0-10.0.113-1.el10_2.s390x.rpm	a578bcddcbd1e5f222bd3e86796d660c8c101848bead7a90b8d1c9fc6421a8b2
s390x	aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.s390x.rpm	b16c8800c4a6f3fbefde86076a3282b4af37757ea027a8188d510099d546457f
s390x	dotnet-templates-10.0-10.0.113-1.el10_2.s390x.rpm	c84770be66082cf14a5dcb8089aafc24626851f9ea9f6868f158f994aff526ea
s390x	dotnet-hostfxr-10.0-10.0.13-1.el10_2.s390x.rpm	d984635f899cbd41238d6567f9afec6c4dfef241e43a5fdfe7ff7585fddc707e
s390x	dotnet-runtime-10.0-10.0.13-1.el10_2.s390x.rpm	d9c216ba3c484ed3fd691da4579fd73bd70d0b43bb8b256f89f66e3d86d06078
s390x	dotnet-host-10.0.13-1.el10_2.s390x.rpm	e66a87d902ef00db6d87025e3668367ce9d26114c0817bc7464c0ce6de642eda
x86_64	dotnet-hostfxr-10.0-10.0.13-1.el10_2.x86_64.rpm	079b28370f6d954311eb2a3be6b7464bc5de7eb656520a0cf0db2dc4f110afd3
x86_64	dotnet-apphost-pack-10.0-10.0.13-1.el10_2.x86_64.rpm	0f0d1a7961fe23002fe7f55b0d5e863584c7df88526962cb8598d73bb6798e23
x86_64	dotnet-sdk-10.0-10.0.113-1.el10_2.x86_64.rpm	2e295a1e20a812e530135ce5b1a774880ba0c9a4aa42ed35df2e82ebd21fd9d1
x86_64	dotnet-targeting-pack-10.0-10.0.13-1.el10_2.x86_64.rpm	4036c7adfbf394a5952831218215dc4d8309c7a368301b587f7c5091d421ba9e
x86_64	dotnet-sdk-aot-10.0-10.0.113-1.el10_2.x86_64.rpm	7be68c16eb9d1b609a908bbc1477d90caca2e1280be86e715068a96db53c583e
x86_64	aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.x86_64.rpm	8999fc2cf2062b3813f1204ff87a0b3b99e8f185b2465323e2ba890e5f11d890
x86_64	dotnet-templates-10.0-10.0.113-1.el10_2.x86_64.rpm	c567ecbe1440f011cb1fea9a7544a0499b4e69ade7acbb9ff533c1e7e602c9c3
x86_64	dotnet-host-10.0.13-1.el10_2.x86_64.rpm	cd14bc15485073831dde24c0b3fbbdc2af5343966de8896962ef9f7a6d8671a2
x86_64	dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.x86_64.rpm	d9b3e1856a709ac20cdbe623e59369ed4e19160b76cc92d0188e9a87237c2de8
x86_64	dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64.rpm	df23dd7ba2b2514abde8f266b293e8e49679ff8074fcc36491c9bf9b291de70d
x86_64	aspnetcore-runtime-10.0-10.0.13-1.el10_2.x86_64.rpm	dff8735847920cfb6d3cd476170fb8855c32f346a2e261bcc698a120fbb89245
x86_64	aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64.rpm	e2f0fa70f92a969cec0f692074f117f055ff6043ad41952a9d4df617edca9e47
x86_64	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2.x86_64.rpm	ef404f7d66f42a462eb50f9c02ca40eae086e38c1a436bffbae706ae1949d114
x86_64	dotnet-runtime-10.0-10.0.13-1.el10_2.x86_64.rpm	f336ad0903ccd2991ca3b1d0e052ddbd7425ef84f5e6db92d3d2197412e4b4c5
x86_64_v2	aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	0d3538d9151109e0632eb6ac69a5787c3cfa6f65698d224bc14544ddaaeeb677
x86_64_v2	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2.x86_64_v2.rpm	15854f6cceaf39c5d0206c350048d5cde37c01a3c825a43af856a15ddf09e34a
x86_64_v2	dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.x86_64_v2.rpm	3469c85ac6fad99c68dc864a0519f79a0bebd9ed2c8a6555a82228567ee00c25
x86_64_v2	dotnet-sdk-aot-10.0-10.0.113-1.el10_2.x86_64_v2.rpm	63261d79bcb9fb3db9b0ea7414a607fe00bcdaee7f98dde8f366f65b9c7d7f87
x86_64_v2	dotnet-hostfxr-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	767f0a76c961d30f6998f7561f4c4558a8af35be8e42b725152434c7273357ea
x86_64_v2	dotnet-sdk-10.0-10.0.113-1.el10_2.x86_64_v2.rpm	7de670c639cc8d5d70764829eb051a9120a19d0821eebbe1ab05d848a705b6bd
x86_64_v2	aspnetcore-runtime-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	888cf1adc181c1265ae731162d19138cb0a3c4068405939283787b8be6327cf1
x86_64_v2	dotnet-apphost-pack-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	96270b68ebf45b9ad708e30d6b696194a1a368c5117648597024ad952866f549
x86_64_v2	aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	9b710a4bcbc86facbce2d6e4eb4dc45d013bfcbc62414f1220a8decbb249a3c4
x86_64_v2	dotnet-runtime-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	9bd79262b4fc4f2a0abb71fa348f24c61c7841bcd733b8271c4c1d4f6cc53c80
x86_64_v2	dotnet-templates-10.0-10.0.113-1.el10_2.x86_64_v2.rpm	a527eedb01f60d5cfe2145d5ca981d4c8d9deac0a6ea766764d3b40b9f01dfa7
x86_64_v2	dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	a617f263698538fc37e68ca05496e8229f39a09ea41b739927dbba5995f97c60
x86_64_v2	dotnet-targeting-pack-10.0-10.0.13-1.el10_2.x86_64_v2.rpm	e1c09f3b1f91f2f7ad5f06053a7e62938acfd40a2877f76d1c13232749e1d095
x86_64_v2	dotnet-host-10.0.13-1.el10_2.x86_64_v2.rpm	f0f144c6bf1968e9b752456d5b0f65cf7e17e151b77cc6ea21372ecaa111bf4b

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.