ALSA-2026:86192

[ALSA-2026:86192] Critical: .NET 10.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 10.0.113  
Runtime version: 10.0.13  

Security Fix(es):  

  * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
  * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:AlmaLinux-277805)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-sdk-dbg-10.0-10.0.113-1.el8_10.aarch64.rpm	01338518a115bc737e2149a81f74c1bf2720a04038aff2acb27b67bc5bd17e74
aarch64	dotnet-templates-10.0-10.0.113-1.el8_10.aarch64.rpm	098346879a9fd81ac43a859951c5e3bd199a9ca8628403b9f9de924965fea7b8
aarch64	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10.aarch64.rpm	1ed424a69c080e5d1eaa4a043860a1a91c9dc22ecce449dbee68c1a15f73b49d
aarch64	aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10.aarch64.rpm	28fd230cdb4e2c6205f0df42e2d7687b1bec1db138f7711ae9d845166bb953a1
aarch64	dotnet-sdk-aot-10.0-10.0.113-1.el8_10.aarch64.rpm	54073d09e9c5a3988eb8b0f9a4affb3eed6fb3a1e66336f0263acc7e9283c45a
aarch64	dotnet-sdk-10.0-10.0.113-1.el8_10.aarch64.rpm	58caac4c61abb3f3bc05361ab518b561c5f02007692a62217ef0c5ed59c05a37
aarch64	aspnetcore-runtime-10.0-10.0.13-1.el8_10.aarch64.rpm	a9e424c9ac2188b298a6d42422b1c26e3e7f69168b039e4d2642f44a6d8ea3c2
aarch64	dotnet-apphost-pack-10.0-10.0.13-1.el8_10.aarch64.rpm	ab250b7a97a81210be6992018074ffd6500fd5065f2cb673057b27109bf8dac9
aarch64	dotnet-targeting-pack-10.0-10.0.13-1.el8_10.aarch64.rpm	c59cd933812b03e3d8043900130ec604258de19f61a045c308a38bfa644cbf83
aarch64	dotnet-runtime-dbg-10.0-10.0.13-1.el8_10.aarch64.rpm	cb54999e27c187f2a3436198136c4d4b8f497903485e8007ef6ebd6980ca78bd
aarch64	dotnet-10.0.113-1.el8_10.aarch64.rpm	d29c637ce503e799aaf5741cfb9da3069b1d700334d1888b9f57a48e40cd786e
aarch64	dotnet-hostfxr-10.0-10.0.13-1.el8_10.aarch64.rpm	e816ecb97f7b80d63fa20c401c5d1cd28dc842a88aa1bd8ba03b0fd6ecedd147
aarch64	dotnet-runtime-10.0-10.0.13-1.el8_10.aarch64.rpm	f0ea1a91626b06cc9385aeff9a3d66b41efef47a4d369b1eb6683c12ec816547
aarch64	aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10.aarch64.rpm	f64c0691afab578d8e57a4746648c832494ba47c5f27c73c07b19b2757a4c861
ppc64le	dotnet-runtime-dbg-10.0-10.0.13-1.el8_10.ppc64le.rpm	3dff41bd2235f018245195e403a19fe6b23159925e3cd1318a952fe18e2cb63d
ppc64le	aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10.ppc64le.rpm	45b432a0575fda43eb0fe45c6a3fe4af0e8e1249e5bf05c29912cc5eb911c44a
ppc64le	dotnet-apphost-pack-10.0-10.0.13-1.el8_10.ppc64le.rpm	4cafdf7b56dca598a609e0724d9197697955d1a3b1178e25cacf1ee695b4ed31
ppc64le	aspnetcore-runtime-10.0-10.0.13-1.el8_10.ppc64le.rpm	4ff25b83bd5fe337a7ee427feccb7f8f4679924e83241a9866698574caf1ff0d
ppc64le	dotnet-hostfxr-10.0-10.0.13-1.el8_10.ppc64le.rpm	972663b361780a87a1764aabf716221ba323dc1eb5ee9d7df54324d659df7e7d
ppc64le	dotnet-targeting-pack-10.0-10.0.13-1.el8_10.ppc64le.rpm	9a716e5f3fe2adb8b007f761278b7e9ecd3b92d85513c49a085c7ba1932ce0ed
ppc64le	dotnet-sdk-10.0-10.0.113-1.el8_10.ppc64le.rpm	b7c9a5f8506a003671897844236635b3ae0bc5f71ab7378b5c8512678c814604
ppc64le	dotnet-10.0.113-1.el8_10.ppc64le.rpm	c78bf43b525275dea5b402cc20104f44dc051db825cd2f2b3d38e15e1c47cc5f
ppc64le	aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10.ppc64le.rpm	cf3314cc3569b60bab8543e7c8ae157a764d935a7ac5fc570a96acdb368a3cfe
ppc64le	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10.ppc64le.rpm	d756f9d53883d3c5086ab381581d85647737560059b309451abf0611149205d6
ppc64le	dotnet-templates-10.0-10.0.113-1.el8_10.ppc64le.rpm	de9309a91a349c653846671966a2b5d8e08acacb598ab26e7b206925071446d6
ppc64le	dotnet-sdk-dbg-10.0-10.0.113-1.el8_10.ppc64le.rpm	df33c771d21752ecfaceeb42fc2836fe92b1e35bc0dd4160df96078caa69e658
ppc64le	dotnet-runtime-10.0-10.0.13-1.el8_10.ppc64le.rpm	f1ecac4da784153aae71d230a882ea29ab78259a7e0be2b97cb817bb0b15d2c0
s390x	dotnet-templates-10.0-10.0.113-1.el8_10.s390x.rpm	189eaccb2be32d4a0da4d31368c6ecbaabb31c0c9782de439957f356987979e1
s390x	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10.s390x.rpm	222efe7e8609850a0371b2c5fd359f460fa78da7a2bdc1ee3877a9fbfa3256d2
s390x	dotnet-runtime-dbg-10.0-10.0.13-1.el8_10.s390x.rpm	2627d3a59a12e4b4df1ac13060784763fb96eef99542fb2ba03e6559d0ebdfed
s390x	dotnet-sdk-dbg-10.0-10.0.113-1.el8_10.s390x.rpm	3c3fbb12e12c67ee8c6864a8ae74d88dac2cbe48cf32de4d382da074c5e593ca
s390x	aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10.s390x.rpm	3f4218290c9474172baa98d12495e43836258b8306156563f9542f72f069220d
s390x	aspnetcore-runtime-10.0-10.0.13-1.el8_10.s390x.rpm	4d0fb378a1c8ea1f72029d74d199cb7b7f66154954a42513984454fe40efeb06
s390x	dotnet-apphost-pack-10.0-10.0.13-1.el8_10.s390x.rpm	5ebddc3be16da2adff31e0fe4390839175ece2e38c76b844c0803d23496d4573
s390x	aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10.s390x.rpm	8cee4b49f5219d79769e75414d262550aff0f199e714858e5dcda04f476bb35f
s390x	dotnet-10.0.113-1.el8_10.s390x.rpm	9cadb78632544df022beb4bccb538cbed08723b878241d41e5964a292b22caf9
s390x	dotnet-targeting-pack-10.0-10.0.13-1.el8_10.s390x.rpm	b06b5697ac80f56983d98714bbbdc122f5e5bd1e028c77a94cc0f4747e1bf74b
s390x	dotnet-sdk-10.0-10.0.113-1.el8_10.s390x.rpm	cce0b6097362187851259757bc9d8c05275ddbaaa99ada093d5ec679d9c27d38
s390x	dotnet-runtime-10.0-10.0.13-1.el8_10.s390x.rpm	d2829f8131db42913071a8318e5b681e0fae28f016c4059c21b624b93140a692
s390x	dotnet-hostfxr-10.0-10.0.13-1.el8_10.s390x.rpm	d31b21eea3659883c4fc5394dfe13a52af3e8a2c8ba2d4b4a8ebeef69f9d2143
x86_64	dotnet-hostfxr-10.0-10.0.13-1.el8_10.x86_64.rpm	20c5ee3a122e6e99d7e17e89e388a17f2d19f3ad59459897ec99aa0f664a9ee8
x86_64	dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10.x86_64.rpm	3a45e6f051516446b04379f3d5d56ba819126b5fac841c53d7b5eebc147620ad
x86_64	dotnet-runtime-dbg-10.0-10.0.13-1.el8_10.x86_64.rpm	85ece18d229f4a1359011894fe7b7ecce2578530e4464b4374f7185ffd11071b
x86_64	dotnet-templates-10.0-10.0.113-1.el8_10.x86_64.rpm	8777f197da18f05962a26c6b40bbc198f71f7af99d8dea197c454b7c342ee129
x86_64	dotnet-apphost-pack-10.0-10.0.13-1.el8_10.x86_64.rpm	8bdc6f651832635b19c9bdd30e6eb9c4ac19e6c90fbfdc936e9a2820020cdff8
x86_64	aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10.x86_64.rpm	8ef3a41a3b1532f20cdc00210182149e33e71ff3055086a0ff2a2691be85518f
x86_64	dotnet-sdk-10.0-10.0.113-1.el8_10.x86_64.rpm	90fdbc7ef5a57c035c924340fce6adbf4536cf9700e0f59b9a22d71aa591ddf8
x86_64	dotnet-targeting-pack-10.0-10.0.13-1.el8_10.x86_64.rpm	95127ecd49af4ece062ecbff1c282e5570025557d0ef85f45956537bf1f84894
x86_64	dotnet-sdk-dbg-10.0-10.0.113-1.el8_10.x86_64.rpm	98fd53f14302cacf8176aabe2642887252edcabe354f1c2572545cd7abf73054
x86_64	dotnet-sdk-aot-10.0-10.0.113-1.el8_10.x86_64.rpm	a8791a5c258c5d64d526cf2fdc2c3d739ef31812d0a9a1599cfb688219e127dd
x86_64	aspnetcore-runtime-10.0-10.0.13-1.el8_10.x86_64.rpm	a8dee680f63d10795e0c3436f8d86ec88938baba9bcc90a7253ccfd0828cfac1
x86_64	dotnet-runtime-10.0-10.0.13-1.el8_10.x86_64.rpm	b480e320dfd94dedcbe8619241e2deb909dc441b2d5018b57629e4f79ff887e9
x86_64	aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10.x86_64.rpm	d14912c9fb6b6eaa154f5321a7438e467a491bf1d11e6b0303ef794b7928119c
x86_64	dotnet-10.0.113-1.el8_10.x86_64.rpm	e1a64788c35b9ef853a2dbfd01ac4362920e9ac5ebce1aadb306a56daefa7279

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.