ALSA-2026:86594

[ALSA-2026:86594] Critical: .NET 8.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 8.0.132  
Runtime version: 8.0.32  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 (JIRA:AlmaLinux-277790)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-templates-8.0-8.0.132-2.el8_10.aarch64.rpm	0fc464fda79baaeda31bd4abbf405a651ffc1762d656ac2885d51bd5917239f4
aarch64	aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10.aarch64.rpm	23d4dc9deb81eb67700203d37938bb51acd2d6669aa6cb756a3d9979257915a8
aarch64	dotnet-runtime-8.0-8.0.32-2.el8_10.aarch64.rpm	5033fb76c293bf8b728d87b7da046701a61c39f769c0fbc7fe896d6d27aac8e5
aarch64	dotnet-apphost-pack-8.0-8.0.32-2.el8_10.aarch64.rpm	5ae815d18c4590a3fe3c35569cf40ebb8f87941032449b15fbc6001fc465e9b4
aarch64	dotnet-targeting-pack-8.0-8.0.32-2.el8_10.aarch64.rpm	690e19d44bfd48356183fb8e3f922ac2e9dc6b43412acc412ac9ed4b38343cf9
aarch64	dotnet-hostfxr-8.0-8.0.32-2.el8_10.aarch64.rpm	84bc55c9910fbada761e32ece0abef3650a6b3e6badf1ca5e2485e11a71bcb0c
aarch64	dotnet-runtime-dbg-8.0-8.0.32-2.el8_10.aarch64.rpm	85a10eb9fc84bb26a39b582466a63b4757f5ac3489d8a46dffe372aacd33195c
aarch64	dotnet-sdk-dbg-8.0-8.0.132-2.el8_10.aarch64.rpm	926d2c81f6f95c495e0bdc6fa7dd35e0ed63735a4f32c1f15535c22b20279f67
aarch64	dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10.aarch64.rpm	95d409fa50f6f80a43b010fea9a4350a16f4bce71bcc4c520d292650f7138350
aarch64	aspnetcore-runtime-8.0-8.0.32-2.el8_10.aarch64.rpm	cc4b72453c24bb73d27aea7f4ea309ee6907618e1f2dd5937802b32584307833
aarch64	dotnet-sdk-8.0-8.0.132-2.el8_10.aarch64.rpm	e6cd562a23271ce72adbbdadcc4ee391f43abbff6d75c7e53dd0adb85c46446a
aarch64	aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10.aarch64.rpm	f3a2847c4d039e807abd81b5993404f67c8ee5d0e8386e72d78f953522d92512
ppc64le	dotnet-sdk-dbg-8.0-8.0.132-2.el8_10.ppc64le.rpm	230a662db4cc54c405a6a63e3a7060bb14b9664fb27fb06c52a43fd092f1d5ea
ppc64le	dotnet-apphost-pack-8.0-8.0.32-2.el8_10.ppc64le.rpm	23475a4f8aeb3582db2df3c27fc181edb680bbf75b1d6861f5193242b2315a03
ppc64le	dotnet-sdk-8.0-8.0.132-2.el8_10.ppc64le.rpm	23c9f94b516a14adf76738e8ae90d3133f03d8c72d01050ea6698d925ed9298d
ppc64le	dotnet-runtime-dbg-8.0-8.0.32-2.el8_10.ppc64le.rpm	25830e97cec98aa83057a0b1ba319a382240a9ef42fce3de0b7efc9896dc1b90
ppc64le	aspnetcore-runtime-8.0-8.0.32-2.el8_10.ppc64le.rpm	431e20732e31331b8b703e675e1718ccd72ab81de155d7c8d21f687113f56fc6
ppc64le	dotnet-runtime-8.0-8.0.32-2.el8_10.ppc64le.rpm	4c110967705c93480488febf5db321db2e80c65d3f0beb0106caa3cf74f0999a
ppc64le	dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10.ppc64le.rpm	4c5caea5b28dd46972f0f17ccb49c25ab9b6cb4e0ee2e57fb75f09a64ccccb51
ppc64le	dotnet-hostfxr-8.0-8.0.32-2.el8_10.ppc64le.rpm	83ff3064e8a2d93ec711701e08a7f5940cc23f74fb8168d74558ae6df92e1401
ppc64le	dotnet-targeting-pack-8.0-8.0.32-2.el8_10.ppc64le.rpm	87414c1bfbae276b44e8826d437e2b9bf9fcc3d70ad40de5c2510588388c0cab
ppc64le	dotnet-templates-8.0-8.0.132-2.el8_10.ppc64le.rpm	b313dcb3a8a4b8207ca4f7ed16134da24c4a1922c49ddd991099e94c6a981056
ppc64le	aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10.ppc64le.rpm	bb50f76ad1b3d222d6ea04dcd4278609b24b982e7e527ec2c1f6e399c9a351cd
ppc64le	aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10.ppc64le.rpm	ff59ec27bd865b3a312f50f6eaf3d5847333ee95bf634e6465f606eef865a839
s390x	aspnetcore-runtime-8.0-8.0.32-2.el8_10.s390x.rpm	07f782e94d13c5907fcb2160b5223ab275f99bb837f4d374c9493ca2a8ed05b3
s390x	dotnet-runtime-dbg-8.0-8.0.32-2.el8_10.s390x.rpm	08aae632bae975f84965d317c01e02d8dde0aa90805a517e01a189ee977ab365
s390x	dotnet-apphost-pack-8.0-8.0.32-2.el8_10.s390x.rpm	0b9939cbae3afb7346917137029d7183d94ed36549c4186ee6a9ca085595562e
s390x	dotnet-targeting-pack-8.0-8.0.32-2.el8_10.s390x.rpm	2c44be9cd3cbc0b3acbb80629a68e2c1a4e7bb93f50ce0e4de7a79ba34dad526
s390x	dotnet-templates-8.0-8.0.132-2.el8_10.s390x.rpm	346febd8e7f204159caf4c54d9c3ef3f713dba099a01ac03062c2bd92866d97a
s390x	dotnet-hostfxr-8.0-8.0.32-2.el8_10.s390x.rpm	4121d15c39a7e6a0501e43d9acd231bb938908f6dce1038a9eef1f8ef8fa56f3
s390x	dotnet-sdk-dbg-8.0-8.0.132-2.el8_10.s390x.rpm	49c871d4249e66a30c69ab5ac51735b3541c32841bbc658bc2dfda64d2d8e4a3
s390x	dotnet-sdk-8.0-8.0.132-2.el8_10.s390x.rpm	a28a9e18fd504fb7123b5b800745ac488d76253e00ec9f00e24970b6266e3b57
s390x	dotnet-runtime-8.0-8.0.32-2.el8_10.s390x.rpm	cdd0a20e4fdeeb6e860d59ce8d806b760f95f96369c9dd1d8e7674307b81f22d
s390x	dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10.s390x.rpm	ded84eae66958e764516499a42166f91eb7da1808c630dd4339c63b92657d0ee
s390x	aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10.s390x.rpm	ed4c0dac70e6dc7fa37757addeaefcf236b2516e68dce4e855a9615d526c2a69
s390x	aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10.s390x.rpm	ed5ec2c24788f26c27ce9f03bbac0775a40b83324bb45e6d2438299123b52990
x86_64	dotnet-templates-8.0-8.0.132-2.el8_10.x86_64.rpm	0f5afdd440431938de95fc8b348d03b8a2185702bd57894be6aad38fe0206252
x86_64	dotnet-sdk-8.0-8.0.132-2.el8_10.x86_64.rpm	6a42d866497d2dcc92fb54dc479db875d551d05da9ac948d5618e4be8bc79506
x86_64	dotnet-targeting-pack-8.0-8.0.32-2.el8_10.x86_64.rpm	727111097d1a32814f47486d04eb00a65f2c85e9ed0b0deffb195da491d16e8a
x86_64	dotnet-apphost-pack-8.0-8.0.32-2.el8_10.x86_64.rpm	73b52aab779239037bf92c641c46ebce4a28aeb05125e911f86dd0383b35b99c
x86_64	dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10.x86_64.rpm	7f8e79b364189ce12e79bdfa464d82cfff07acf1a76205f33cbb6e7cd8c0144a
x86_64	aspnetcore-runtime-8.0-8.0.32-2.el8_10.x86_64.rpm	8476d4a691f4df0aad413d2143f757c5db2a83bc84d12028d0be48458f30a92e
x86_64	dotnet-runtime-8.0-8.0.32-2.el8_10.x86_64.rpm	9aefe792ae0637dd1fade4b9965de58a71a3a5eb5b3ba761f9ebbfc3e65e0c0e
x86_64	dotnet-runtime-dbg-8.0-8.0.32-2.el8_10.x86_64.rpm	a1e3ae2858049df3bf948e237a7a843803efec9966b88153d7c1dfc8944ba4f2
x86_64	dotnet-hostfxr-8.0-8.0.32-2.el8_10.x86_64.rpm	ae0a05badad9380812b163e32e579b7084e6d1b7062edb2f4be77043dac2ab5e
x86_64	aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10.x86_64.rpm	af87e6dbebb7275ac9668d1ac67ecb7c8b677b1134694ff39e9a066e5d24a5e7
x86_64	dotnet-sdk-dbg-8.0-8.0.132-2.el8_10.x86_64.rpm	b38f073a349b590d11f1ec9b98e4239d51822ffec8ea482bc934eeb0a354e633
x86_64	aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10.x86_64.rpm	e355146cc76bbbf64b5157bf00e0161f1e6f86f80d0a734cb82c1ce2f6c7842b

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.