[ALSA-2026:41896] Important: .NET 9.0 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-07-31
Description:
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 dotnet-sdk-aot-9.0-9.0.119-1.el9_8.aarch64.rpm 0c863d208ef0ba0bb25c9693fc67c91dff20f72d516e862e13a8b1c70791a762
aarch64 dotnet-runtime-dbg-9.0-9.0.18-1.el9_8.aarch64.rpm 2df79510887f416e9269d42f932c2478c103fc0d12a53f6548e19353afb92c37
aarch64 dotnet-templates-9.0-9.0.119-1.el9_8.aarch64.rpm 35616a8c343272b9c3f62e673a88a03a626f7c00be94c330a0d0ed3ae1289335
aarch64 netstandard-targeting-pack-2.1-9.0.119-1.el9_8.aarch64.rpm 47a92b82ab7a41fd6cdffcaa5dbfb3144224e41a8a015afcafee040e024b5b03
aarch64 dotnet-sdk-dbg-9.0-9.0.119-1.el9_8.aarch64.rpm 4a8d16e72cd866fbe4c8530efda4d08fc3daf123ac4cae3389463eca8520f495
aarch64 aspnetcore-runtime-dbg-9.0-9.0.18-1.el9_8.aarch64.rpm 67dcc4490e931a53d28ce5c05cec3b66921268821ffda5e4345393109f77ecf3
aarch64 dotnet-hostfxr-9.0-9.0.18-1.el9_8.aarch64.rpm 6f06d1ab8f771092a305e91db7d79b78dde5a339c9cf40b562052f9ff35ff93a
aarch64 dotnet-runtime-9.0-9.0.18-1.el9_8.aarch64.rpm 870a39d1fd4f081a06afe8de458431dd39e136e237d20b4de9158264d7883717
aarch64 aspnetcore-targeting-pack-9.0-9.0.18-1.el9_8.aarch64.rpm 8cc0347eae1d336676f436b2ff31e1b61ab0819afaee18277ed6161ace870aa3
aarch64 dotnet-sdk-9.0-9.0.119-1.el9_8.aarch64.rpm a50e5ce47921b09fe316b936b91cd8417b8d31de7b62b493422fe5419b095db6
aarch64 aspnetcore-runtime-9.0-9.0.18-1.el9_8.aarch64.rpm ab18466d45018ba8fe37dbed69a83ecd3912d22c61ef6e98e87396ed9e9eb55b
aarch64 dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.aarch64.rpm b4193cd2e9507e1b1c3fa604ce96cb6c54a7df41b7b515682fc583cecae4bfae
aarch64 dotnet-apphost-pack-9.0-9.0.18-1.el9_8.aarch64.rpm c79cf92309cc4a5d99fa188879b009efcfb5ce8e3ae15149a3352db233adb309
aarch64 dotnet-targeting-pack-9.0-9.0.18-1.el9_8.aarch64.rpm fa44605275d83b2881132d7dc37688f10ca0f32ff6b6713fb6b5452ee878f0a2
ppc64le dotnet-templates-9.0-9.0.119-1.el9_8.ppc64le.rpm 072dcf8e60f6df0097893f0b5de43ceb6072f49f3dff76a0f1805333d3725713
ppc64le netstandard-targeting-pack-2.1-9.0.119-1.el9_8.ppc64le.rpm 0b654d886893c999020577441032d0b8fe3b5afd9ad17532debb4b9d4866eecd
ppc64le aspnetcore-runtime-dbg-9.0-9.0.18-1.el9_8.ppc64le.rpm 2792558401466ed7c410a98dfca12372341239e91998d60c3a590f20ba0752ba
ppc64le aspnetcore-targeting-pack-9.0-9.0.18-1.el9_8.ppc64le.rpm 350ea2fdea08e9d7d455432054bf179ade5e2221d9737ff73632a03f9ba43a44
ppc64le dotnet-apphost-pack-9.0-9.0.18-1.el9_8.ppc64le.rpm 4d5da79efdbe49e03f3aa0b1d6a3e7c48543011ab4d76cee457e5a439d37b508
ppc64le dotnet-hostfxr-9.0-9.0.18-1.el9_8.ppc64le.rpm 8be0dcdd9e2265c4263c5b1982b7d0d39620bdaae843be8cdbdc7dd7c4b3c684
ppc64le aspnetcore-runtime-9.0-9.0.18-1.el9_8.ppc64le.rpm 9312fdc1cb68390a1a787be5a8e211a2172d8463d482c66d435065b0eaf04cda
ppc64le dotnet-sdk-9.0-9.0.119-1.el9_8.ppc64le.rpm a903f55edd1df9f405a7277137063afed761c671ddc2d3bcd7d08460a30a0921
ppc64le dotnet-sdk-dbg-9.0-9.0.119-1.el9_8.ppc64le.rpm b4d65e46808e1a30cc78bade481d694643a70f828774a6d0d85e968f925a0807
ppc64le dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.ppc64le.rpm d36586973a89710da337ad18da56876e94daf411d3967602fa0349b0193fbb39
ppc64le dotnet-runtime-dbg-9.0-9.0.18-1.el9_8.ppc64le.rpm d4305576d1ee3fc8f9d45d48b908e75900e9c908c8ff7b93433d2eed2d5f7f06
ppc64le dotnet-runtime-9.0-9.0.18-1.el9_8.ppc64le.rpm ef90670d1ca1aaebecfb3dcc5e8d07b5aaa83e503b206820b0f43014188e111c
ppc64le dotnet-targeting-pack-9.0-9.0.18-1.el9_8.ppc64le.rpm f20b6a05fd1be3940a59c69ffb2dc1a28b36ff9ac6268892d7ed3d191d2752c0
s390x netstandard-targeting-pack-2.1-9.0.119-1.el9_8.s390x.rpm 04856efc27751880d03b96adac29b23fcedcf65a1eb06915efb1cd7cf33c0d36
s390x dotnet-runtime-9.0-9.0.18-1.el9_8.s390x.rpm 0775d05bf1f3b3ad1888764f6e0e08bdb2f139b0392b58ed9a53900e3744149e
s390x aspnetcore-runtime-9.0-9.0.18-1.el9_8.s390x.rpm 0fa5f21097568a97bf772b55c9cd92c06666891afb15cf3c44404c72e8686c11
s390x aspnetcore-runtime-dbg-9.0-9.0.18-1.el9_8.s390x.rpm 1c85d9955ea0a3b43e3dc43f15d96e84bf6f5c19a500543e4d2465f70d39eb89
s390x dotnet-targeting-pack-9.0-9.0.18-1.el9_8.s390x.rpm 1d2a0d811d311a4ef5d313c2a9c7e2d18c275ae8b302e8a25f66c16d493d2190
s390x dotnet-sdk-9.0-9.0.119-1.el9_8.s390x.rpm 377f14bf1f8dd9221a60c32eea4476b142e00623136329858aa849dec6f7bc14
s390x dotnet-runtime-dbg-9.0-9.0.18-1.el9_8.s390x.rpm 4e71529625f833d292fc0f0609bcc6f69d2d9a69633cae4ec49e7104bc06e708
s390x aspnetcore-targeting-pack-9.0-9.0.18-1.el9_8.s390x.rpm 61193e273749a7abd59e5a99a721297027d874aa3a60cec430332e76b40388aa
s390x dotnet-apphost-pack-9.0-9.0.18-1.el9_8.s390x.rpm 87eb8b1ef5d9447996a59a976741a717f5fc8ba89f9ef02669f97e8a74c87b6d
s390x dotnet-hostfxr-9.0-9.0.18-1.el9_8.s390x.rpm 89a7abea8078bc1ae348a5c8f3c0c481ef160e93800b1b9b79e7c57b7cc99f5a
s390x dotnet-templates-9.0-9.0.119-1.el9_8.s390x.rpm a150c70633a56b02eeb9aa94dca0787f6f799f1e5a7305166f5275ce00484428
s390x dotnet-sdk-dbg-9.0-9.0.119-1.el9_8.s390x.rpm cbce3067ddd8fd897a160624a7e02b31f0e39993539b7f2fc6ae3f4a9b14fb48
s390x dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.s390x.rpm e46a984281b088f158cf2130ff5bfa5befc82e377272e3798994b44eff528c04
x86_64 dotnet-templates-9.0-9.0.119-1.el9_8.x86_64.rpm 037939bf2111e062fda014fb5a5c5585a086ef4e9af46d3f220185030a6188e9
x86_64 dotnet-runtime-9.0-9.0.18-1.el9_8.x86_64.rpm 066bb4a2fcf0a9cb388e1b835019424d8557c780001a12b2011d74b7acb1ba2b
x86_64 dotnet-sdk-dbg-9.0-9.0.119-1.el9_8.x86_64.rpm 0cf4d1e0fd069856674ec31febc424f422a8a12cb4c1569795e2abd0c61f535e
x86_64 dotnet-targeting-pack-9.0-9.0.18-1.el9_8.x86_64.rpm 0dbfe0eaa6fdb713246a540cc544d1836a4b8e19d0bf88b953ed145351de6c6d
x86_64 dotnet-sdk-aot-9.0-9.0.119-1.el9_8.x86_64.rpm 216943392b3ff925229d2baa510c32c415d744b4ca309e817b54736066b7bce2
x86_64 dotnet-runtime-dbg-9.0-9.0.18-1.el9_8.x86_64.rpm 379eda65d820f95373285e7bbd5a66d3b1eeaee34a1cfe8b6aec2f990b3d249f
x86_64 dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.x86_64.rpm 55e8a460bb9f360c4c9b58396d9004daafc5580ba7023b5cdab3a4bddf8331ea
x86_64 dotnet-sdk-9.0-9.0.119-1.el9_8.x86_64.rpm 603d02a1d9f9af9c7f50320c432e931303f91fb9fc071707d8262df24403d9a7
x86_64 dotnet-hostfxr-9.0-9.0.18-1.el9_8.x86_64.rpm 82b5a59b9327a82b150c9625773efb555a233d678bd45f4406d6774f0439e03b
x86_64 aspnetcore-runtime-dbg-9.0-9.0.18-1.el9_8.x86_64.rpm 93304c21bd9a1127795f027ecaeb74e13c6ad6d574fd1c91fafceac599dbeff4
x86_64 aspnetcore-targeting-pack-9.0-9.0.18-1.el9_8.x86_64.rpm c7d557dda0d4f5f2f87e5754b77f5a4ef08575595224637915b7618d2e70f9e1
x86_64 netstandard-targeting-pack-2.1-9.0.119-1.el9_8.x86_64.rpm c95c7a1d028e934d824e1b101620b70b2279697ab85f3b164344bf17de843c89
x86_64 dotnet-apphost-pack-9.0-9.0.18-1.el9_8.x86_64.rpm cd4dcb56713f4c059d12d0ed2028749acffd8855f5affc7f7b9f7263ad711211
x86_64 aspnetcore-runtime-9.0-9.0.18-1.el9_8.x86_64.rpm ce3b57815f489d0300bacdf99fc7632bb611e1d31dfb15c67f8fef1646e797e8
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.