ALSA-2026:41898

[ALSA-2026:41898] Important: .NET 10.0 security, bug fix, and enhancement update

Type:

security

Severity:

important

Release date:

2026-07-31

Description:

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462)
  * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	aspnetcore-runtime-10.0-10.0.10-1.el9_8.aarch64.rpm	040b7a978c11c42b75a4a67a563348bc921599c825c417c7ab4ecea7e5e7adce
aarch64	dotnet-sdk-10.0-10.0.110-1.el9_8.aarch64.rpm	05576a4a958db216f74c1113b9a883bb9748d04aec5b59b0afe9d0d085d15904
aarch64	dotnet-apphost-pack-10.0-10.0.10-1.el9_8.aarch64.rpm	1898d479ef35243696209e2607575c825b47c8b47df5f8902750ae372d4682eb
aarch64	dotnet-targeting-pack-10.0-10.0.10-1.el9_8.aarch64.rpm	1c6ea1d3348f0d803775a3285dfe81dd1fccfb3201b844c7fa1cbb39d3d69459
aarch64	dotnet-templates-10.0-10.0.110-1.el9_8.aarch64.rpm	360f18b25f22606f56170da59007becbd2346148eece86c1aa8cba95e03a88a2
aarch64	dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.aarch64.rpm	4aa4c36e33393554bce309d5da05519be1e0773d4f584a88de3680aa0c1c4aae
aarch64	dotnet-runtime-dbg-10.0-10.0.10-1.el9_8.aarch64.rpm	5fabd7a13734caf0806932c834f57c6f835798893645e38a2e0dfa5a6306ce27
aarch64	dotnet-runtime-10.0-10.0.10-1.el9_8.aarch64.rpm	6be40fab118a49008569d2190cd910e385d072e1753a26a1527e627f87a33ce8
aarch64	dotnet-sdk-dbg-10.0-10.0.110-1.el9_8.aarch64.rpm	c0b9ede59cdb157dc9909e9807883c9ee08fc3d8d88ce43ddc8bb0d842121b01
aarch64	dotnet-hostfxr-10.0-10.0.10-1.el9_8.aarch64.rpm	d1c4d0acef1d6933af583a3c08b6766a374f72fbfbe570ee420e6e3a7cdf6a8d
aarch64	dotnet-sdk-aot-10.0-10.0.110-1.el9_8.aarch64.rpm	d1e22a512bce193c2302ecdb9029a868561f7a2ab2cb686ea20be59e7d4d1531
aarch64	aspnetcore-targeting-pack-10.0-10.0.10-1.el9_8.aarch64.rpm	d2530da16286b13290a20b8986ce742a62d40994099bdb64f40573baaa812e1c
aarch64	aspnetcore-runtime-dbg-10.0-10.0.10-1.el9_8.aarch64.rpm	d388e876afa8d69a9c036032b0f4d1f85397f1cd73ef294acd14fbdf4e63f781
aarch64	dotnet-host-10.0.10-1.el9_8.aarch64.rpm	ff0a9e0cdbaf768dc0816dd0878fa28ed5cce80f4a3141f03508fb0a20a48070
ppc64le	dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.ppc64le.rpm	1482833751f0663460a6f9f0e2ff70f881204acb12122e429df452cae3285680
ppc64le	dotnet-templates-10.0-10.0.110-1.el9_8.ppc64le.rpm	26e21a4878ce44ca7803a788decfb9fef9bd11982f0889a11e8d27ba39042017
ppc64le	dotnet-hostfxr-10.0-10.0.10-1.el9_8.ppc64le.rpm	2bb2a490368c300d368580ff2bac92b95c1d7b239881ee88dcd0033ff913361f
ppc64le	dotnet-runtime-dbg-10.0-10.0.10-1.el9_8.ppc64le.rpm	2c6e38dd063a52d93084e57b76f7c7cd1ec7ed5961d51eff216d4fb383968959
ppc64le	aspnetcore-targeting-pack-10.0-10.0.10-1.el9_8.ppc64le.rpm	41ab73ba39578648d96a9ce9e3afb916d0b4808042eac2b547b548bbd47b53b1
ppc64le	aspnetcore-runtime-dbg-10.0-10.0.10-1.el9_8.ppc64le.rpm	4b5f6cbbefc0c67d5f7e11dd4d99d4985dbcfa10fcd6fda808c96f444b5b9f7e
ppc64le	dotnet-sdk-10.0-10.0.110-1.el9_8.ppc64le.rpm	569976ebcb547cf732a0c2e64106dd536b139a6cec493e294a3b1add6ca01276
ppc64le	dotnet-apphost-pack-10.0-10.0.10-1.el9_8.ppc64le.rpm	5bc338a6858b23c09814241cafa949a03807bffbd4be65bdd789583bdddb1d5f
ppc64le	dotnet-host-10.0.10-1.el9_8.ppc64le.rpm	5dc9c18cb1fff5ac59a52c2da08c0265df36063d675b605a55b476b21e7e676b
ppc64le	aspnetcore-runtime-10.0-10.0.10-1.el9_8.ppc64le.rpm	74f362805ee8f611a21dbb70b0073eb0fd9766069e2f0600c57edcac25c8893c
ppc64le	dotnet-sdk-dbg-10.0-10.0.110-1.el9_8.ppc64le.rpm	a2051945e737deac8f0ac2657a9cbdd227f7f74bdb4d4f796c4f6541d335f7b1
ppc64le	dotnet-targeting-pack-10.0-10.0.10-1.el9_8.ppc64le.rpm	e63efcfbb0cd374ef334fa0972ee87ebef7412566712d01ae0bef8a49913cb4a
ppc64le	dotnet-runtime-10.0-10.0.10-1.el9_8.ppc64le.rpm	fa5b5941397df5b808113603bdf6da069ec5e63f791d86f7c5e3457a3b3f9124
s390x	dotnet-runtime-dbg-10.0-10.0.10-1.el9_8.s390x.rpm	0d518fd489554ef91c4a39a95191324e252def644152b352b94fd54fa007ea64
s390x	dotnet-templates-10.0-10.0.110-1.el9_8.s390x.rpm	32e7dda4a31df62fc3838b465010cb1cd39ef3b7e5dcd999ec5a9b650c6cbedd
s390x	dotnet-hostfxr-10.0-10.0.10-1.el9_8.s390x.rpm	48e61987c9a4e97571cf043d831c0a418fa84ee996fa65144622faab2de4f30b
s390x	dotnet-apphost-pack-10.0-10.0.10-1.el9_8.s390x.rpm	61a6f10198f7c1a728a4fb987b1765b4aa654dd17189416af926301da30c62d3
s390x	dotnet-runtime-10.0-10.0.10-1.el9_8.s390x.rpm	63273c0ecc2e1573a6c6f01a68c9d391dc515493140828cc8f57c552ed6a0f32
s390x	aspnetcore-runtime-10.0-10.0.10-1.el9_8.s390x.rpm	6f90cadb7c88d5811fa80ea4daebd6bd46eeb166c0c9c7cc91952f9dfed69d0a
s390x	dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.s390x.rpm	8a7018670059e9b2c237ba8048364c6584358148ec1cdb8480925fc9f3650bb9
s390x	aspnetcore-runtime-dbg-10.0-10.0.10-1.el9_8.s390x.rpm	b5100457884c04699d2cb887e4c80cba098811c29cbed63505e222779d6003c7
s390x	dotnet-host-10.0.10-1.el9_8.s390x.rpm	b85a683b485ae7f302c36da088023a9b8ca7b635bab12bae5562b97e8f476589
s390x	dotnet-sdk-10.0-10.0.110-1.el9_8.s390x.rpm	c5b8ea5eb3c8f8d562a917983a000bba3e65d00590b7b1836ce123f11a92fd2c
s390x	aspnetcore-targeting-pack-10.0-10.0.10-1.el9_8.s390x.rpm	cdb28724a561a10adbb3705735e4a514fafd47b13aa395b2c3db79a78ee4818e
s390x	dotnet-targeting-pack-10.0-10.0.10-1.el9_8.s390x.rpm	f483fbbc43e4bb6918e126cddc8474a9de8105a8d06cb7abd1bcddc0ccc9d2f4
s390x	dotnet-sdk-dbg-10.0-10.0.110-1.el9_8.s390x.rpm	f736208539d0a3e2b567923b6a688b43b831629b55afb88e97db02cdaed93657
x86_64	dotnet-host-10.0.10-1.el9_8.x86_64.rpm	0357aaecb8c49467a6502466599253e29d1433d5980494d310cb371145575d8e
x86_64	dotnet-sdk-dbg-10.0-10.0.110-1.el9_8.x86_64.rpm	223dbc77cf0f582bf7b5c5df6eade48a16467ac92be90687a0eb93b4e13c6445
x86_64	dotnet-runtime-dbg-10.0-10.0.10-1.el9_8.x86_64.rpm	3ed48d7aad3f57d956af26782b7a30b2ec510e1c1b4a8f367094180f9b945b5a
x86_64	dotnet-sdk-aot-10.0-10.0.110-1.el9_8.x86_64.rpm	4d81b353947ed28b601feaf3b8656c8deb0c83a36ed5a6d26290942e87844ce8
x86_64	dotnet-sdk-10.0-10.0.110-1.el9_8.x86_64.rpm	67b627f968c6b8a800d196def7ca9d61964252ccec71c578c85f9800b0a81119
x86_64	dotnet-targeting-pack-10.0-10.0.10-1.el9_8.x86_64.rpm	6d96dd3236bd3a0d16218f39ba13d6e3f01213a137ffab3f2e340fff43a28aae
x86_64	dotnet-runtime-10.0-10.0.10-1.el9_8.x86_64.rpm	72a37e467e17fde60e26fbc5c2f363d4fc45bfb3678c8b151f6dc6b295fe7779
x86_64	aspnetcore-targeting-pack-10.0-10.0.10-1.el9_8.x86_64.rpm	7d8d42e015cdc2730a72cdf3ffd8d8f9e7c18a632c6f1ca0dc713caf07a44435
x86_64	dotnet-apphost-pack-10.0-10.0.10-1.el9_8.x86_64.rpm	92fb843152399123fe8e35358f44d1980c585b8a1ebf13da274f02ee98a84165
x86_64	aspnetcore-runtime-dbg-10.0-10.0.10-1.el9_8.x86_64.rpm	a489b9890b2af39351b99bc1b4469e866bda0d11602610788db9c53293d8daa2
x86_64	dotnet-hostfxr-10.0-10.0.10-1.el9_8.x86_64.rpm	cfeb9767c515d8320ab682328cbd9ea91bf9e708a0eafd24c76d5b5241671c38
x86_64	aspnetcore-runtime-10.0-10.0.10-1.el9_8.x86_64.rpm	e34eaee1d2226802ca02c7dc535f5efaa791950540d95022a08bbdd1376bff15
x86_64	dotnet-templates-10.0-10.0.110-1.el9_8.x86_64.rpm	e42b19bd3b0d365e2b9590d6e141f3eded0f51473c2614984b9d9975c30339a4
x86_64	dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.x86_64.rpm	fcad26c029468961b8e1c85a0ab7857c183f170db151783552b4f2968b7b9c90

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.