ALSA-2026:41899

[ALSA-2026:41899] Important: .NET 9.0 security, bug fix, and enhancement update

Type:

security

Severity:

important

Release date:

2026-07-31

Description:

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:AlmaLinux-192469)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-runtime-dbg-9.0-9.0.18-1.el8_10.aarch64.rpm	00606b66be82fd7675b48496a11c35c3b719c1406ee5e33e1b0ec2291a570bd2
aarch64	dotnet-runtime-9.0-9.0.18-1.el8_10.aarch64.rpm	057645faeb6a9d61e1092cbbfce7bb500c508086920a8a2aad5dbcdace0a71b9
aarch64	dotnet-templates-9.0-9.0.119-1.el8_10.aarch64.rpm	1165445a6d58f9cb7f479767f4b092347eb361116728e075dbdb17f8ed684329
aarch64	netstandard-targeting-pack-2.1-9.0.119-1.el8_10.aarch64.rpm	321bb0f43be3146fd50fa629be10d4522beb4a1236a4659c6a7e064fa2afb460
aarch64	aspnetcore-runtime-9.0-9.0.18-1.el8_10.aarch64.rpm	58b4345cf8b1574a0b25aa9fff3fdbe63002ff927e020f085c9f63904f0bb09d
aarch64	dotnet-sdk-aot-9.0-9.0.119-1.el8_10.aarch64.rpm	9f45efff7f77e1b34249620fe98994983295ca1a6dd6a2f341d18a00c88d4836
aarch64	dotnet-sdk-dbg-9.0-9.0.119-1.el8_10.aarch64.rpm	be201284df0ab5b2024537e987663c758cebdece792f79b08ca138feda758f1c
aarch64	aspnetcore-runtime-dbg-9.0-9.0.18-1.el8_10.aarch64.rpm	bf5da0d595fb93a0febd03e13a9aab20c02bf4641be02abf88bdfe7c64b5fa4a
aarch64	dotnet-targeting-pack-9.0-9.0.18-1.el8_10.aarch64.rpm	c14463bd6eabfa30d0012dc786c9e1acb607dfd9e100eb97d0836312ef8eb7e7
aarch64	dotnet-sdk-9.0-9.0.119-1.el8_10.aarch64.rpm	d46853be240d7089a852ca743230c02bd31b6b31645e452ef3a3ed361b948cfa
aarch64	dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el8_10.aarch64.rpm	e3f69905d43817fee7c331cd2285bad007addff16afff7cd3d3759da652cb2a3
aarch64	aspnetcore-targeting-pack-9.0-9.0.18-1.el8_10.aarch64.rpm	eaba953489a6b385afaba52114c18215398e9e7a68af33a3d131402a2dc3a966
aarch64	dotnet-apphost-pack-9.0-9.0.18-1.el8_10.aarch64.rpm	f50209889cc7e3ae2d3df023b919a37d268ba6e745ad7ed6fb2d2a07ecc49eed
aarch64	dotnet-hostfxr-9.0-9.0.18-1.el8_10.aarch64.rpm	fcd0f820090805bc6dffde8e9bb81bf4a759021ae288dfa3df8b12112df70870
ppc64le	dotnet-runtime-9.0-9.0.18-1.el8_10.ppc64le.rpm	228eedf08c1cf96fd7e62b680487ffb1b1f71bd27971e394c28a263f1770d0e2
ppc64le	dotnet-sdk-dbg-9.0-9.0.119-1.el8_10.ppc64le.rpm	30eb7b7791ddb28524ab5fed021c6b42b12e31f6dcc898b294897663117b9f3b
ppc64le	dotnet-targeting-pack-9.0-9.0.18-1.el8_10.ppc64le.rpm	37bde12c2e4e1715f820e9b301456ffd643df93b9a1665443022a098d4af8a87
ppc64le	aspnetcore-runtime-dbg-9.0-9.0.18-1.el8_10.ppc64le.rpm	44acbfc7ef328072d1186dab9cf206fa1ab69c463aeb0bf302b3ee4f75bc006d
ppc64le	aspnetcore-targeting-pack-9.0-9.0.18-1.el8_10.ppc64le.rpm	62a67b0730027e4d57a99ff316ef2eef136116c1d63677fdd406b0e0d51778f2
ppc64le	dotnet-hostfxr-9.0-9.0.18-1.el8_10.ppc64le.rpm	8ed933fcf7d13b4b25866a7cced4b41268550d6ef945a1baef083aade17e4ac7
ppc64le	dotnet-runtime-dbg-9.0-9.0.18-1.el8_10.ppc64le.rpm	8fc4c79f2cd988537c4ceb2110b0212d176c711800766296b1d95f49f4d2bdee
ppc64le	dotnet-templates-9.0-9.0.119-1.el8_10.ppc64le.rpm	a055017235641cc44a96c4ade339ed60672c46578209b5d6c7c897dc548ba3ec
ppc64le	dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el8_10.ppc64le.rpm	a0aa82334e51c69e9fa81ed3f79125bea978c8a1fde149364317de3e48db360d
ppc64le	dotnet-sdk-9.0-9.0.119-1.el8_10.ppc64le.rpm	a3b44af39733c1b2ba4433096807b89e4155b01c0e15c6b3b16b70029d267a14
ppc64le	aspnetcore-runtime-9.0-9.0.18-1.el8_10.ppc64le.rpm	e7e5b40f147209c5d6da349fa140d8ab6b212f85ecf4a5acdd3f2fb437cfa107
ppc64le	netstandard-targeting-pack-2.1-9.0.119-1.el8_10.ppc64le.rpm	f452417fac825692f5e44972b65b1784b820f2e89d33c3a75787423d8f5f3f8b
ppc64le	dotnet-apphost-pack-9.0-9.0.18-1.el8_10.ppc64le.rpm	fc002d2df617c282c0f676ff56743336f6fcc71d273ce65244670920fbfb48ba
s390x	netstandard-targeting-pack-2.1-9.0.119-1.el8_10.s390x.rpm	02493e574308264c3aa1d07624f6bcdc42f394f33333285b6b6bc7786418dde1
s390x	dotnet-targeting-pack-9.0-9.0.18-1.el8_10.s390x.rpm	0831b6e3748c9205e139927af60df2d2c014790995a539e0b8654db5f440e673
s390x	dotnet-apphost-pack-9.0-9.0.18-1.el8_10.s390x.rpm	3f10c7ac29ac241e462eaaecd2d35cdcc8fae8f1e969e13de581d3cd4d98274a
s390x	dotnet-templates-9.0-9.0.119-1.el8_10.s390x.rpm	402f74e53e0ff51c55563a0ae09f70a4e5b996347afadadf399b1eae80efa0fb
s390x	aspnetcore-runtime-dbg-9.0-9.0.18-1.el8_10.s390x.rpm	493c864ed8beb63e16ff7aa94e6a116938063574072c64158101a96781e2ae20
s390x	aspnetcore-runtime-9.0-9.0.18-1.el8_10.s390x.rpm	770d831328ca310645902cb9dbea08550b56b75707ad14e86afa267cf9b6d8ed
s390x	dotnet-sdk-9.0-9.0.119-1.el8_10.s390x.rpm	85f4e95ec9e59dcf3e6dd6f4a1a8cc1faae510ea6a7d7f46f6ae6e11180c6abf
s390x	aspnetcore-targeting-pack-9.0-9.0.18-1.el8_10.s390x.rpm	87d774fcaade66c03185a67f984b16c80c959fd9ad44ed6dab432fcd1fc068f1
s390x	dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el8_10.s390x.rpm	937de8ad27e4eff75f2b1621ac12ae649453f97d4dc6428fcea57e2c5774f00a
s390x	dotnet-runtime-9.0-9.0.18-1.el8_10.s390x.rpm	b68eb3f4e8ad11bab0c0510cd9d42ca4788aca631ae038054bf0a2e1cfc45358
s390x	dotnet-sdk-dbg-9.0-9.0.119-1.el8_10.s390x.rpm	c3d1cee47c8a27933585af8851f28317a31f2eaebd0563e5608856096580c1e1
s390x	dotnet-hostfxr-9.0-9.0.18-1.el8_10.s390x.rpm	c3fbe23198b4511d0eee208a1c45f795d8253defa5fcff61c385b1fb155bb91b
s390x	dotnet-runtime-dbg-9.0-9.0.18-1.el8_10.s390x.rpm	d19123d2c18c3a86ae39f1877eafc0a19ff2e1041eb7a484972674bafb8c64a8
x86_64	dotnet-hostfxr-9.0-9.0.18-1.el8_10.x86_64.rpm	030ee0eb881236aac1fe7325d4739ff15b59665cd3a166ebf7c9cabd2cd4b65b
x86_64	dotnet-targeting-pack-9.0-9.0.18-1.el8_10.x86_64.rpm	177bf2c4d3178526e61ba177d3db147c8ee513c37e85c3cb01c3491f2d409df1
x86_64	dotnet-sdk-9.0-9.0.119-1.el8_10.x86_64.rpm	2a296e713fd48632ca7138519a5a8318e5ac4b11b155c72c192af8b0fc2bbe6b
x86_64	dotnet-sdk-aot-9.0-9.0.119-1.el8_10.x86_64.rpm	39d745953e7965de4b7ce97e0bf645b0f5e56f78176c53b7aab79ea2e21cb3da
x86_64	aspnetcore-targeting-pack-9.0-9.0.18-1.el8_10.x86_64.rpm	3cfbf6e8b0455f0ec9ced43e42fbf61890ed0d5c316a2f6cd38ba74a35f32e2c
x86_64	netstandard-targeting-pack-2.1-9.0.119-1.el8_10.x86_64.rpm	421d27511099c9b1fe390eb1a7f4390ad678641008976d042f380cf81fb759dd
x86_64	dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el8_10.x86_64.rpm	63799914740cb5e9c79b3489b0fff832471141aa5cf804c4ab12fffefd9e55d4
x86_64	aspnetcore-runtime-9.0-9.0.18-1.el8_10.x86_64.rpm	6ee343a0d638967eca0a36b32db5056917bed5a3018d66f479d4f225ff4166ed
x86_64	dotnet-templates-9.0-9.0.119-1.el8_10.x86_64.rpm	a495bea070910e82951bd3bac7fe9ee4a5af86b4cb274f99357d4310c6cc1d90
x86_64	dotnet-apphost-pack-9.0-9.0.18-1.el8_10.x86_64.rpm	ad247c08388713add41cde60e17353b5a2d1ad371b3e1a1a2f09f52cf879b4bb
x86_64	dotnet-runtime-dbg-9.0-9.0.18-1.el8_10.x86_64.rpm	b788c2356ab6db702c97cf0420e847cf356a59911d0ae8617a4ceacab6274af6
x86_64	aspnetcore-runtime-dbg-9.0-9.0.18-1.el8_10.x86_64.rpm	c09b6c967d6526fdeb20835a57e709b4132fa9c312ba135bca45cd2949ab5e27
x86_64	dotnet-runtime-9.0-9.0.18-1.el8_10.x86_64.rpm	c8084d3e164aa5a68e10d03ff6e1989d32975b9fb6afe5502eeb0685effb8b93
x86_64	dotnet-sdk-dbg-9.0-9.0.119-1.el8_10.x86_64.rpm	f8a6a88a34246e9fc4b22ef7eb4bb72a3249f0106584740a58ac0c5816d330cd

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.