[ALSA-2026:41894] Important: .NET 8.0 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-07-31
Description:
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 dotnet-runtime-8.0-8.0.29-1.el9_8.aarch64.rpm 04a3cbf6d66623c867cea8432d6e620533dfe86f14b3a9e5f985fe32befe818c
aarch64 dotnet-hostfxr-8.0-8.0.29-1.el9_8.aarch64.rpm 2964c0c36eaecf735b73bbb258531679af2d2109f103af5c7a091716747856c1
aarch64 dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.aarch64.rpm 5a416437de77e57bbc5ab511c4c4f2b3ca1d56c935fee51d1d6601ddd7ee4f3e
aarch64 aspnetcore-runtime-dbg-8.0-8.0.29-1.el9_8.aarch64.rpm 6f367fb19b62b9bbfe81e61f00e7ab5afb024a696d7911bfa02073b789f412f4
aarch64 aspnetcore-runtime-8.0-8.0.29-1.el9_8.aarch64.rpm b4b485f432e5a07d49b831ec1e74bafc6f4128b9a6c3c4c3bb7d5a0bc5e3ba5c
aarch64 dotnet-sdk-8.0-8.0.129-1.el9_8.aarch64.rpm be05ee443942da4cfe79448a6376577eb673202afa794cf9e96b77b99a593022
aarch64 dotnet-templates-8.0-8.0.129-1.el9_8.aarch64.rpm c1cceae28684ecdecb88a083747a25a3d386db51ca7a98ba4a7d52e918b2b7ac
aarch64 dotnet-sdk-dbg-8.0-8.0.129-1.el9_8.aarch64.rpm d69b1e6ec99d5fbc5d4fca0140709b667681393e8a6ec71d0c55dffc780847a9
aarch64 dotnet-targeting-pack-8.0-8.0.29-1.el9_8.aarch64.rpm d6e96e0cdb802d7aa5703c7173c61642c0173134e108eebd2b857909e349eb7a
aarch64 dotnet-runtime-dbg-8.0-8.0.29-1.el9_8.aarch64.rpm ddf69ae7654665d7b71611762e4156b2057fe4fc621b47c0dbaff85bdbf4eca9
aarch64 aspnetcore-targeting-pack-8.0-8.0.29-1.el9_8.aarch64.rpm ec0aa8bd8e1805ca63fe1aae0f7385767bd8427b70379e378c22bc076a45a8cc
aarch64 dotnet-apphost-pack-8.0-8.0.29-1.el9_8.aarch64.rpm fc59b7cadee3c0c4e08983ff58477015cbacf29d0689cc8d7a2b63700d606460
ppc64le dotnet-apphost-pack-8.0-8.0.29-1.el9_8.ppc64le.rpm 0d41d076719c99427106e923571a0b5efe52b1ac34cb4beb2af4b3719e39e363
ppc64le dotnet-sdk-8.0-8.0.129-1.el9_8.ppc64le.rpm 173c644cc23809f5808c87478d59988108f940b8ea330d6e3b755685524f7a05
ppc64le dotnet-runtime-8.0-8.0.29-1.el9_8.ppc64le.rpm 17f6cfc18c6b5a2f8becc470f4b6e8adb83eb6bb48db9225a5c7627bbc1d85f2
ppc64le dotnet-templates-8.0-8.0.129-1.el9_8.ppc64le.rpm 355370480112337ecc3f33c788c3efd2ffff904739c6b6f5b8aa9a1baccc66ea
ppc64le dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.ppc64le.rpm 40c8c439dd3c8c15ba72ff0f84ee07b70e6d7bb6f8f72b12687a2ccf244e99a7
ppc64le aspnetcore-runtime-dbg-8.0-8.0.29-1.el9_8.ppc64le.rpm 5fe6c1b7e1fbc8e457ab85346094860bf3cc56d5dbbea088ea290a92fefb9588
ppc64le dotnet-hostfxr-8.0-8.0.29-1.el9_8.ppc64le.rpm 6cb44892b74b9163d38c1248eff639120d53f18501efcb093fe2f61ab69cf6c8
ppc64le dotnet-targeting-pack-8.0-8.0.29-1.el9_8.ppc64le.rpm 78f12a51a1ce1b752e76a52ffd565ee11f8a878808b0ed3794107172c3d0a88f
ppc64le dotnet-sdk-dbg-8.0-8.0.129-1.el9_8.ppc64le.rpm 7917d6c09bc24e2446866e0a108c74f1e6887fff3e46a3586d07ce209decc157
ppc64le dotnet-runtime-dbg-8.0-8.0.29-1.el9_8.ppc64le.rpm 868226c5ebf5420a106d89efdc98f7de70b75e6a796728764ddb802de1a39390
ppc64le aspnetcore-runtime-8.0-8.0.29-1.el9_8.ppc64le.rpm 8f64c512b65c01252e68e2b9c679e1b8b1818af61a30f7bc133388ddaed2dfb2
ppc64le aspnetcore-targeting-pack-8.0-8.0.29-1.el9_8.ppc64le.rpm f4baba336c2c99d04a19c643911159e3be68da2574e8d1cb0823a9e221723b12
s390x aspnetcore-runtime-dbg-8.0-8.0.29-1.el9_8.s390x.rpm 29810e1e7106a4899900f156a9f898a53dc86617268e6e014a5e6bf15a297829
s390x dotnet-sdk-dbg-8.0-8.0.129-1.el9_8.s390x.rpm 324e10766eb48730c97c931bb8d1022277722c9b7a4d20a850c397ef7fe85dfa
s390x dotnet-runtime-8.0-8.0.29-1.el9_8.s390x.rpm 3ebfbc7a555bb00b246105a7a4121be1fad54978e9fb85cb6593cccb176eb6aa
s390x dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.s390x.rpm 596c162a48dc3f7772e3211b95f5d2ff355bffbf2cd13d63df1732117780ea1d
s390x dotnet-hostfxr-8.0-8.0.29-1.el9_8.s390x.rpm 68a804dfefc4219c207d782d048955a531ef529e55acf938e7c8e02cf7e0c2b3
s390x dotnet-sdk-8.0-8.0.129-1.el9_8.s390x.rpm 71c00e840090cc4571300a450a21df059020fe901d963ea63ae06c2baa99f55e
s390x dotnet-targeting-pack-8.0-8.0.29-1.el9_8.s390x.rpm 734c0205b70e2e980c7b4e43a3581c87c18700918f5cbe413ac08165a29d94d4
s390x dotnet-apphost-pack-8.0-8.0.29-1.el9_8.s390x.rpm 74ae5acf1b1e79edb4572990466ab2b4f426699dda989b898204af2f1506401c
s390x aspnetcore-runtime-8.0-8.0.29-1.el9_8.s390x.rpm 9aa0b1a81affcd826f58f1b44481e540facf467ec22e60cf74369c6c6c8a1010
s390x dotnet-templates-8.0-8.0.129-1.el9_8.s390x.rpm d451c6f74d3f4e03588b2bfb6fc4ed39b20cff270772c6e890f3c526a16cbf06
s390x dotnet-runtime-dbg-8.0-8.0.29-1.el9_8.s390x.rpm e73859aa37f38dbe8f906a172650aafa2c53217894c2056613acc36197727fe6
s390x aspnetcore-targeting-pack-8.0-8.0.29-1.el9_8.s390x.rpm f1d1ffe3e3a399da110a23ba5c3f2e726b7bb7574e138cbe22de7ac78eaf7ca1
x86_64 dotnet-runtime-8.0-8.0.29-1.el9_8.x86_64.rpm 42e056567b3fcc25ace3684b1ebd19a589dfdc8fa638927dda14506c10047699
x86_64 dotnet-targeting-pack-8.0-8.0.29-1.el9_8.x86_64.rpm 49863161677b581d71c4ca648b69f23d983480dd19aeeb0a2a7e207493996ed6
x86_64 dotnet-runtime-dbg-8.0-8.0.29-1.el9_8.x86_64.rpm 61307e80110c09d70f5cbea83cb247d80c90d8fed8658dd55b9191698c848f35
x86_64 aspnetcore-runtime-dbg-8.0-8.0.29-1.el9_8.x86_64.rpm 67e9bae19136700d4473a265e77058dee31e6817b0620c5479eb0fd6f457d833
x86_64 dotnet-sdk-8.0-8.0.129-1.el9_8.x86_64.rpm 6db44f12773b5d3ed42a6d80612e6372692f302884b399ddfe7a753a35a90361
x86_64 dotnet-hostfxr-8.0-8.0.29-1.el9_8.x86_64.rpm 720d7fb3a74d78fec534658859d36ae328572b5ec4e15e77b392da904e4e5398
x86_64 aspnetcore-runtime-8.0-8.0.29-1.el9_8.x86_64.rpm a5a11d3fb29bafd863c9a93ec6dd63558208e8ca0f891e11ffd3181096af49e6
x86_64 dotnet-sdk-dbg-8.0-8.0.129-1.el9_8.x86_64.rpm b816c11b99282ae3c7e69b14c79d83d772e5b570d1215b8f6e09c30d38668614
x86_64 dotnet-apphost-pack-8.0-8.0.29-1.el9_8.x86_64.rpm be6932d0e0e8c40e3e3c678134cd0d7b44e820e66bef399dc567f5aad620c636
x86_64 dotnet-templates-8.0-8.0.129-1.el9_8.x86_64.rpm cb9a3fab700f32fd7a2b6b08455ec8de227384cb4b95d66a0096523f7f8dfb6f
x86_64 aspnetcore-targeting-pack-8.0-8.0.29-1.el9_8.x86_64.rpm db32bb43e252f06063513219541e975caa49ac29261272ad5dc322569e9a6ded
x86_64 dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.x86_64.rpm e30ca52a5fd5a3bc93c8bfc564002632385a506a9fe9e30e717d467b2b9071c7
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.