ALSA-2026:86170

[ALSA-2026:86170] Critical: .NET 9.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 9.0.122  
Runtime version: 9.0.21  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 (JIRA:AlmaLinux-277797)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	aspnetcore-runtime-9.0-9.0.21-1.el8_10.aarch64.rpm	0ea0eb8898f0cc40146efe0258dddbd680dec873cbba1c4afd3196496262d9b7
aarch64	dotnet-sdk-9.0-9.0.122-1.el8_10.aarch64.rpm	155b43761c198c50b2800700e7951319f2b5e19d7361ae41373ebdce11f9b37d
aarch64	aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10.aarch64.rpm	34de4665983ce2b8a82208e56ed12aab6536bc90cffdf43dc23d6130a4d31014
aarch64	dotnet-sdk-dbg-9.0-9.0.122-1.el8_10.aarch64.rpm	4eef35c9bb54ebe62ff02c7b95fd62f9aa79ab011b97dcf9395e12d7de424249
aarch64	dotnet-runtime-dbg-9.0-9.0.21-1.el8_10.aarch64.rpm	5b3c4f6d4cc58910f68d3c6076dca53a369d94a0108868149fa1d33403212cc9
aarch64	dotnet-hostfxr-9.0-9.0.21-1.el8_10.aarch64.rpm	67f90bd32a6d4736505ecc5225860cf41142a76fea9e6f6ad85fdd45bc2f52da
aarch64	dotnet-templates-9.0-9.0.122-1.el8_10.aarch64.rpm	89735b7e27848a1a68119e7913b28cbadc32e9073a21b3f56373ac8cd4debd79
aarch64	dotnet-apphost-pack-9.0-9.0.21-1.el8_10.aarch64.rpm	91d64c7016bd73b5298aafe0fbca6fcccd6089ec626078947b5ffeb5ce806e16
aarch64	netstandard-targeting-pack-2.1-9.0.122-1.el8_10.aarch64.rpm	b8ea34c62a1bf7b8f984bcccb6352e20d8cdfe3ba5b859aa08fc95da86ab5e69
aarch64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10.aarch64.rpm	c47859cb30ade3a99e152bb3c144d5e50949d1b22c5a1a89eaea4a2a9df534c5
aarch64	dotnet-targeting-pack-9.0-9.0.21-1.el8_10.aarch64.rpm	c66db19dc8f70f72f37222523b6ee73f9cba3b8cd069ba1bf217b7dc33ffdd7e
aarch64	dotnet-sdk-aot-9.0-9.0.122-1.el8_10.aarch64.rpm	dc7c381f9b8e4910f42d71ec7ccb53d191270ea889de1ff26539420c0fa0a55e
aarch64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10.aarch64.rpm	e8250b1cebb846d6980bcefafdb5d6f8d99000808213eb8a9d34481b5b4fd7a6
aarch64	dotnet-runtime-9.0-9.0.21-1.el8_10.aarch64.rpm	ecaac4e2886064ac2847bcb22bce7b6002f38287b090d7e3da32aacf168998a8
ppc64le	netstandard-targeting-pack-2.1-9.0.122-1.el8_10.ppc64le.rpm	04551ac2adc9aaded8794721a17daf04cd0a61addce6ac816866e58d73fba98d
ppc64le	dotnet-sdk-9.0-9.0.122-1.el8_10.ppc64le.rpm	0d741667b65feac4dedc213666fc63d981c96167ec3df35be88872cdd0127ca1
ppc64le	aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10.ppc64le.rpm	356f8f1f52a2ee54983e6cb907353a61bf57b0bfe2627b95f30763dcb8289bb8
ppc64le	aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10.ppc64le.rpm	4033081130884cd8fa453e171310acd926a870c7e37f359e2285d3cb43472a89
ppc64le	dotnet-hostfxr-9.0-9.0.21-1.el8_10.ppc64le.rpm	4aa93e9009b68b5dcea1da3b12d340808e6ea992421e640c6b1d0a68c554049e
ppc64le	dotnet-sdk-dbg-9.0-9.0.122-1.el8_10.ppc64le.rpm	65fc91168e0f4d36c9c8b50da683b49abca96718db1c91b9ffa3840e7b925a83
ppc64le	dotnet-targeting-pack-9.0-9.0.21-1.el8_10.ppc64le.rpm	891b913fc15a96630f4b68eb5673c64e10ac2f32529b9844238f7473d8a7b1a8
ppc64le	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10.ppc64le.rpm	8f97988fd3ac0482cc6de9f701c43e084ba915507d03e8406474a263a809d49c
ppc64le	dotnet-apphost-pack-9.0-9.0.21-1.el8_10.ppc64le.rpm	ada679afdf3a3f2d37cc66bc83a48bc78c8865ab9d0109f4abfc81e524aa5311
ppc64le	dotnet-runtime-dbg-9.0-9.0.21-1.el8_10.ppc64le.rpm	bd8befb97165e047c0d4484836baefa21fe8fc3c52daa7348d08c067e92fbf05
ppc64le	aspnetcore-runtime-9.0-9.0.21-1.el8_10.ppc64le.rpm	c81d62bf29886f460abfd2899620b89c7257ff50aef434ab53ad0e59d44bae1b
ppc64le	dotnet-templates-9.0-9.0.122-1.el8_10.ppc64le.rpm	d8916e582386435d683c64bac80f9af88d5e2235db29d47108b875b0220a842b
ppc64le	dotnet-runtime-9.0-9.0.21-1.el8_10.ppc64le.rpm	fc1da1ae48f86271a5c265f2924fd7903bfc5b57ebd5e81dbf2ee04be99e139a
s390x	netstandard-targeting-pack-2.1-9.0.122-1.el8_10.s390x.rpm	04c9edf070facb970eb7a8b41e4c74b0b1ce6389b83917acfab66bc32da3236d
s390x	dotnet-runtime-9.0-9.0.21-1.el8_10.s390x.rpm	11666dc4e8d70207ba0755b842489165a5d2abcb7c17441edea3d089e1d0d776
s390x	dotnet-templates-9.0-9.0.122-1.el8_10.s390x.rpm	4d63d1c8e3f7f59845ea231e277658d6cc53117152ae85fc32b88fcc3c0c5353
s390x	aspnetcore-runtime-9.0-9.0.21-1.el8_10.s390x.rpm	5703db75a6ce5925c7f1d12ce8b27a2569d750359efceb41ff9412b30d5040bf
s390x	dotnet-targeting-pack-9.0-9.0.21-1.el8_10.s390x.rpm	6559e6ccc57dc38aa74dbe12dbab19a378b545b31c307287055c03f4393568a4
s390x	aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10.s390x.rpm	897cf8cb206c6da3f4c289ef55b5e46048f16bcd54c3a38a43854b608fc9be7a
s390x	dotnet-sdk-dbg-9.0-9.0.122-1.el8_10.s390x.rpm	9a68a2851b0864a53755f5f2643ffec2ae6c3cee9108668a86cdda408a219bf5
s390x	dotnet-sdk-9.0-9.0.122-1.el8_10.s390x.rpm	9f24de3c42195bf2a4cc85ebcc66ae2eaaaff7ce396f95ed05dbcb8e1a9f46f4
s390x	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10.s390x.rpm	a1985d75d6a8f7ab064926979b3dc790623b8d7024328d784a5888a1b1db6a1a
s390x	dotnet-apphost-pack-9.0-9.0.21-1.el8_10.s390x.rpm	a53a8e71c47f1e6b0c98831fcdf66787ddb02d42cc6b655dc96792cf5d0c92a9
s390x	aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10.s390x.rpm	b358649b76625cdad78664d80d326f0bfabacdd294cc1104970f6327d09bc8fc
s390x	dotnet-runtime-dbg-9.0-9.0.21-1.el8_10.s390x.rpm	d87fee54611761c22a1169b6d35f343c9e67d3154f4f7449dced66fc3a732dbc
s390x	dotnet-hostfxr-9.0-9.0.21-1.el8_10.s390x.rpm	f467cc9dd4dc9c10ac17ba19658d2a905f3520c21586cdf0b5d9e889b8f77aaa
x86_64	aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10.x86_64.rpm	1983e772b6be2b86018b17c03534f124bd68de8b46973d9a212cf87d4c481de9
x86_64	netstandard-targeting-pack-2.1-9.0.122-1.el8_10.x86_64.rpm	1ef6077d53f8423173b985d125da34664127530eee868b823fe169e69df96c21
x86_64	dotnet-apphost-pack-9.0-9.0.21-1.el8_10.x86_64.rpm	318b5d1ca876e52d4f156f1a46123d86a85705479ccd9d4bc5bd747254166836
x86_64	dotnet-sdk-aot-9.0-9.0.122-1.el8_10.x86_64.rpm	50d68ecb19f19deefa9b08854aff311a466fccc14a5251b633e8ca9a7b8410c9
x86_64	aspnetcore-runtime-9.0-9.0.21-1.el8_10.x86_64.rpm	6be6df4ce2c0bd49970681a00f7b1a218002350e7bf2f4d40b7986971f204769
x86_64	dotnet-sdk-dbg-9.0-9.0.122-1.el8_10.x86_64.rpm	7131b7f51a0f11a6f2048f40d183c0a4b01d7381979efb62f007715109f7a7f6
x86_64	dotnet-runtime-9.0-9.0.21-1.el8_10.x86_64.rpm	73111cffc22185100750ee40e50a639e84fb03550101c7787b318196c21f1928
x86_64	dotnet-targeting-pack-9.0-9.0.21-1.el8_10.x86_64.rpm	7ec395795aac9f491f90fc3eed47e6a564883d9db51404c2a9719c0334b0a4f5
x86_64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10.x86_64.rpm	8306a30d839d3c29da71b10673c63e316e0b253a45222885a47f79245e428f74
x86_64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10.x86_64.rpm	9ffeb6ec1c95356cd948983180f2b9041d8f2a82f1d02f4dfd497e51348a1f2b
x86_64	dotnet-templates-9.0-9.0.122-1.el8_10.x86_64.rpm	b4777030ecda3d2cfd79d93349bcb5c89d7c32fe41d482f6a6bea2c741577225
x86_64	dotnet-hostfxr-9.0-9.0.21-1.el8_10.x86_64.rpm	c103a09af89fb5fff86b4707d68414f143793a56764115b2957c5361ed0e7b78
x86_64	dotnet-sdk-9.0-9.0.122-1.el8_10.x86_64.rpm	fc5d75553e024be41651ffe065f0b5807e34c8384cee8dd69b3051a32dbdf060
x86_64	dotnet-runtime-dbg-9.0-9.0.21-1.el8_10.x86_64.rpm	fde8cc6401cb1295419e16972dda59c97e96694a5ff113fc2938ea0cddfbb1a7

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.