ALSA-2026:86171

[ALSA-2026:86171] Critical: .NET 9.0 security, bug fix, and enhancement update

Type:

security

Severity:

critical

Release date:

2026-10-21

Description:

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 9.0.122  
Runtime version: 9.0.21  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-9.8.z] (JIRA:AlmaLinux-277800)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	dotnet-hostfxr-9.0-9.0.21-1.el9_8.aarch64.rpm	12d2c39088e9e79f220603e4c697c1170ceae94d61bc698c9bc09fd053b169ac
aarch64	dotnet-sdk-9.0-9.0.122-1.el9_8.aarch64.rpm	14bb27942cc459ef6abe92e8a3469e482f17272ff5dac2afbf1cc51d49e3ddfd
aarch64	dotnet-runtime-9.0-9.0.21-1.el9_8.aarch64.rpm	2459932c11987483a483e6ca33b0c12466fb3f6f9c42acce7bc86dce2586d681
aarch64	dotnet-apphost-pack-9.0-9.0.21-1.el9_8.aarch64.rpm	27dda6548af7d6ac009a0b8ab8be7287d7f06a30248fed57e757cee6988c2ef0
aarch64	dotnet-sdk-dbg-9.0-9.0.122-1.el9_8.aarch64.rpm	284fb02145db3cde489f24e4915d41df8cf2af5c182461750fbc6688ea23d5c0
aarch64	dotnet-targeting-pack-9.0-9.0.21-1.el9_8.aarch64.rpm	3072a02bc415ac680ea81bad649678bf3fe43b6fef2916005ff0d5dbb54e386e
aarch64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.aarch64.rpm	4168f0076e72607709024c7c03fad0be749846af0f3f08046c0c0d849a4a87c0
aarch64	dotnet-runtime-dbg-9.0-9.0.21-1.el9_8.aarch64.rpm	4a6a1de49405cbe0358a2f553d3aacc6d4fa3cb5030cb493b465a171b12402aa
aarch64	netstandard-targeting-pack-2.1-9.0.122-1.el9_8.aarch64.rpm	799629e59244ae94c2f0d2d63977a5d505aa348f24207e99e3a30e757142478f
aarch64	aspnetcore-runtime-9.0-9.0.21-1.el9_8.aarch64.rpm	8ec1db54e4960bc1bfa8f2bf17076937ce1ad74f973f3d6e0a0b755c4d25a537
aarch64	aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8.aarch64.rpm	a222ee03310c037c60591eb40072d41bd439c9ae5ca24fb616315a9210d16b88
aarch64	dotnet-sdk-aot-9.0-9.0.122-1.el9_8.aarch64.rpm	a624a1ff7c891934358d6a15ba10b7482940b0e629a3be13cef5b21718252bf1
aarch64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8.aarch64.rpm	acb21c8c3b14ee53ba29cdfe5b96138eb932978b20b031301156a98c30a773a8
aarch64	dotnet-templates-9.0-9.0.122-1.el9_8.aarch64.rpm	cdb13294d5a8ec30adb0d97b26621e273662674fe05a99b75f61e6714db4f687
ppc64le	dotnet-sdk-dbg-9.0-9.0.122-1.el9_8.ppc64le.rpm	02df1ca2e84f32fb3a8addde079e0e7c1e39b8d628e0ac10e9b6c27ab5c67317
ppc64le	dotnet-runtime-dbg-9.0-9.0.21-1.el9_8.ppc64le.rpm	0e177183d4049607cfed3671333195a9c3fb392409524c8619961e39fe85548f
ppc64le	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.ppc64le.rpm	0fe869c5d3ea8f117507698cdd266ae0fad64aeece3f9ac9582dfacf6b060e79
ppc64le	aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8.ppc64le.rpm	160a053ed11b75374ad4bcc5e85a58057487451f714fa6d0bf3ea79bfd8887e0
ppc64le	dotnet-targeting-pack-9.0-9.0.21-1.el9_8.ppc64le.rpm	4b310e48ec306f9ca4ee051735a5b581b9dea78c8cbb3577691a43d80f6faf0b
ppc64le	dotnet-runtime-9.0-9.0.21-1.el9_8.ppc64le.rpm	51a7db5fb5ed85080d4a24198d9a27ba8a5c107b98b2fe2ef5c529116a934468
ppc64le	dotnet-sdk-9.0-9.0.122-1.el9_8.ppc64le.rpm	7ddcf43cc06d8919a2426ceadcfa23336d3a5d3a4681989adf3d2a01dfa9b9af
ppc64le	dotnet-templates-9.0-9.0.122-1.el9_8.ppc64le.rpm	80225d0fdbf74d4735a243eaf24d96ca21497a220126dd4cb7c31471177c2699
ppc64le	aspnetcore-runtime-9.0-9.0.21-1.el9_8.ppc64le.rpm	83e925798b635af25d1ecedff445213fe7f7bed3002c3f85263e9e974236726d
ppc64le	dotnet-hostfxr-9.0-9.0.21-1.el9_8.ppc64le.rpm	8a2827308bacf1180932d2603ff9cc80ef15acdd4feacc5a14b9e237bd996f7e
ppc64le	netstandard-targeting-pack-2.1-9.0.122-1.el9_8.ppc64le.rpm	c120167ab1088b1ceca602a042ace1903f7d809cbfa284afa41002aac6a35191
ppc64le	dotnet-apphost-pack-9.0-9.0.21-1.el9_8.ppc64le.rpm	dd505cb7605311e1c96027f0353ee90026efff13eb85d6baa3b00c2ab1d40537
ppc64le	aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8.ppc64le.rpm	e4e04191d33bdf64988800ecf8595ff228f903aeeb5dda8b55ac8145f4e085bc
s390x	dotnet-apphost-pack-9.0-9.0.21-1.el9_8.s390x.rpm	2232c1a053835ae40969d40ec92f198111ad8b801d296401fe1404b43ce6d583
s390x	dotnet-templates-9.0-9.0.122-1.el9_8.s390x.rpm	4ac494ed8c614dcc5f27dc050625264e0b2e5c2a43565907c684f62e55097ae6
s390x	aspnetcore-runtime-9.0-9.0.21-1.el9_8.s390x.rpm	64b849d962c222d0bcfba9d77374859d4025ecdc52646bea8b310950b37e78e0
s390x	dotnet-sdk-9.0-9.0.122-1.el9_8.s390x.rpm	67bfbf04884681239058c98da7c7f3c7a91c14b76b6ebe71677c809ae7e4147d
s390x	dotnet-hostfxr-9.0-9.0.21-1.el9_8.s390x.rpm	6bf1b5602f31b91bcfb0dff178ec67537193898fa2727d1a3359fac8fbc64fd0
s390x	dotnet-sdk-dbg-9.0-9.0.122-1.el9_8.s390x.rpm	71d58f124b6c996b7ee328c90ff904ccd2f8cd805e3bff436b17c3fba7d65f80
s390x	aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8.s390x.rpm	74c675315c78759929060fd410583225f56993eb730f14862ab050fe5568bd7c
s390x	dotnet-runtime-dbg-9.0-9.0.21-1.el9_8.s390x.rpm	8b50fe0b1e570781cd72bbec69e227db5b6b186094d7f2052a876c056dbc3f78
s390x	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.s390x.rpm	9a8d499378f33d6a92e32f853abb6b850cd772029d911749bd30a354bc34189a
s390x	dotnet-runtime-9.0-9.0.21-1.el9_8.s390x.rpm	aa22149b54e7b4dfdf41b5a92f0013df1113f9cc9f5820cff4274c525b81e045
s390x	dotnet-targeting-pack-9.0-9.0.21-1.el9_8.s390x.rpm	d2c3ba898c3992e4aaaf91b1962099d2431f2f7a33dd6f479fd9bd41743e701f
s390x	aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8.s390x.rpm	eb5604f3ee4510683219697bdeaa3467ba204b15845c58b4274812253add281d
s390x	netstandard-targeting-pack-2.1-9.0.122-1.el9_8.s390x.rpm	ff83ceeefb9becdaf512b6eefd9ba56f3536e7ad7ff2c164faa2b97583b7907f
x86_64	dotnet-runtime-9.0-9.0.21-1.el9_8.x86_64.rpm	0a30fafba1494cdeec77b44958c61490d7cdc832e2af5a293c3bbdbccaa46055
x86_64	dotnet-templates-9.0-9.0.122-1.el9_8.x86_64.rpm	0f27ba343ef7117be314030226059e428a33f0aa35f5a9e6b4bb9c383849b63d
x86_64	dotnet-sdk-9.0-9.0.122-1.el9_8.x86_64.rpm	146e8be717e7c46b76f450542e13996e9b3ceb9d1c6fb3ba939de7ec4e97c8d4
x86_64	dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.x86_64.rpm	20d2d6d445f2065cb8308343067693e13f4d31353cd9bbc8395607e6dd0a2994
x86_64	aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8.x86_64.rpm	30efc57a3e71be31df3e4110b2849f9fd6f35c0d84b51e4cac0fb56c41a7c472
x86_64	dotnet-hostfxr-9.0-9.0.21-1.el9_8.x86_64.rpm	34477cf55699bab70edaadd86d81f2f5df10cf846862a4db92f52b0c1dcb292b
x86_64	dotnet-apphost-pack-9.0-9.0.21-1.el9_8.x86_64.rpm	77beedbb4e5710afce2bd22039f0dde56fed13b5285beb884cb2086a89441f4e
x86_64	netstandard-targeting-pack-2.1-9.0.122-1.el9_8.x86_64.rpm	7f63553e7b09897190777dfa8043c6d6f5458f8f29f1cda25d2968d90d80bd62
x86_64	dotnet-targeting-pack-9.0-9.0.21-1.el9_8.x86_64.rpm	a4dce9dc757d424e582ec287dba92a3c0b44fb113d48f14b99b0bff0fc391d59
x86_64	dotnet-sdk-aot-9.0-9.0.122-1.el9_8.x86_64.rpm	ae6599bb6e0f50d20972898e096060df7197e2ea6cb6fd9df2ce14ad55250182
x86_64	dotnet-sdk-dbg-9.0-9.0.122-1.el9_8.x86_64.rpm	c918222d101515899a8594554484db3c7de1f5d1ea053a190f07a6257e28a013
x86_64	aspnetcore-runtime-9.0-9.0.21-1.el9_8.x86_64.rpm	d500d55d6aefd9b638b59bae6a1ceedef57c944a732186952e6cd5e6841d155a
x86_64	dotnet-runtime-dbg-9.0-9.0.21-1.el9_8.x86_64.rpm	f939f2f613e4630a3243ce947a73527f0a6c7ad12bd534648dfc7b4f915b5916
x86_64	aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8.x86_64.rpm	fe4c70f2a2c81605a839e5adf6f3d76e44479b8e2fea0df8d73080417646a198

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.