[ALSA-2026:86193] Critical: .NET 10.0 security, bug fix, and enhancement update
Type:
security
Severity:
critical
Release date:
2026-10-21
Description:
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-9.8.z] (JIRA:AlmaLinux-277808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 dotnet-sdk-aot-10.0-10.0.113-1.el9_8.aarch64.rpm 2eb9e52eb7eab91708fd924d0e6e0ad3e883c0870ff3f904d4f875f943908446
aarch64 dotnet-templates-10.0-10.0.113-1.el9_8.aarch64.rpm 3613bee5c83c6bb70f06feedbe2c4a1566fdc5bb0a4fd06aa70d0cbdc5b76957
aarch64 dotnet-targeting-pack-10.0-10.0.13-1.el9_8.aarch64.rpm 3ad3310fead3717d5ec9bb774744da513018c64c7698ff6b8079a3880b231124
aarch64 dotnet-apphost-pack-10.0-10.0.13-1.el9_8.aarch64.rpm 3d217a3a9150e727117b9975448108a64e7470b1ff108d6198c7c1d6715a1047
aarch64 dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.aarch64.rpm 465696e88c3bfc4565d826818233710d5f05c0c23bc85cf1162b605e465cf1d4
aarch64 aspnetcore-runtime-10.0-10.0.13-1.el9_8.aarch64.rpm 7d1f8831aea435a0c8a3a0a77a84971661d8f74454c54af250a4c7417aae6b14
aarch64 dotnet-sdk-dbg-10.0-10.0.113-1.el9_8.aarch64.rpm 868b8936440483b9339b9f935ee6638128c91f6e071bf91c967ba22e6877da79
aarch64 dotnet-runtime-dbg-10.0-10.0.13-1.el9_8.aarch64.rpm 8acf26cbcdb6a8711fec1a0b9586fb9062f2c408af6b1dd3f0eed3917733a21b
aarch64 dotnet-host-10.0.13-1.el9_8.aarch64.rpm 8f2b7822384045447d3ae94ba99000607f683dd36090d17263cb84f05ea4134a
aarch64 dotnet-runtime-10.0-10.0.13-1.el9_8.aarch64.rpm 98e9de2c6e4b72c4354648abf9a7597b2780f052840c298956c8713e6ab51d26
aarch64 aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8.aarch64.rpm ad32c84f74c1c76bd31770596c74fc87d3b005847cf48129ca1fa07df5f2fb27
aarch64 dotnet-hostfxr-10.0-10.0.13-1.el9_8.aarch64.rpm b04fad387e57c2de0e16dc398e0e10e683624f7be5217942413df527fa035ead
aarch64 aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8.aarch64.rpm df1819f59131d5525b1864ad8dae2764f30892a8e5f6c76ba5c3810759b055dd
aarch64 dotnet-sdk-10.0-10.0.113-1.el9_8.aarch64.rpm f1be3d11fff971358bf1ae7c21efa548356ceb85a253385fac19f4244fe8d7b8
ppc64le dotnet-sdk-10.0-10.0.113-1.el9_8.ppc64le.rpm 02514d873a05bbaf171b0f2e836dea352ab3ee4fc630f96164efc6a86d87412a
ppc64le dotnet-templates-10.0-10.0.113-1.el9_8.ppc64le.rpm 05549298980b62484205517701cd8ae69f4fdbeb469879e0371d7c6596cce067
ppc64le dotnet-apphost-pack-10.0-10.0.13-1.el9_8.ppc64le.rpm 0804e8e53fe0e621454014eb5ea1d2b8bcd747073cd15b8c29dc969bf11e054d
ppc64le dotnet-hostfxr-10.0-10.0.13-1.el9_8.ppc64le.rpm 1d83498518d09208b1ddbdecbd6a8dd6245cbfa14d9e5d8f850a8b292623f9cd
ppc64le aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8.ppc64le.rpm 7825a6cd0de7a26fb774414f4fce08f9f50f7d36e52b7d5fd64168417c4eb911
ppc64le aspnetcore-runtime-10.0-10.0.13-1.el9_8.ppc64le.rpm 81dffce6241a26bf858d5bcaa18bb1c641af991f532dcc564a18e2f3f18ff695
ppc64le dotnet-runtime-dbg-10.0-10.0.13-1.el9_8.ppc64le.rpm 8ceb42680b4f97a576c0d647d91040716de2aed44f8ebe0b38abefdbebe49659
ppc64le aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8.ppc64le.rpm 902b6d1b63943d53ef53793477f899e298269e907cdae1a6edfc692f5ef7c76f
ppc64le dotnet-runtime-10.0-10.0.13-1.el9_8.ppc64le.rpm 99a58ae76d0910f9e1dca656430b6d7acf44b0cee7cf106efc59b21d54ae3418
ppc64le dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.ppc64le.rpm baec5e20a32fe993b259711ff1ac36b6f36db5fd1beea5c942dd84656d465fa4
ppc64le dotnet-targeting-pack-10.0-10.0.13-1.el9_8.ppc64le.rpm c9efe7b96d765ccc067bf30c3f25bb4b31f66a7272420c7e58f21779a08d9e90
ppc64le dotnet-host-10.0.13-1.el9_8.ppc64le.rpm d874e3e3acdcf3fbaa65b9250a4ba874ccdbc73db5305a8723da2fe3c18316e7
ppc64le dotnet-sdk-dbg-10.0-10.0.113-1.el9_8.ppc64le.rpm dfa178482d7a39289d0385aac4ba3dc203caf72c77c45d3d1482db8138360f9e
s390x dotnet-sdk-dbg-10.0-10.0.113-1.el9_8.s390x.rpm 1431868b39a0aba9292ca5c272dcac610fd21c778f69f36d8330f85af1f97dd0
s390x dotnet-hostfxr-10.0-10.0.13-1.el9_8.s390x.rpm 3538b88c006ef8e581612561bf9f1f400fdfcce9454699950eac1d6739c5fb42
s390x dotnet-runtime-dbg-10.0-10.0.13-1.el9_8.s390x.rpm 3673fd382d2ee14f1ac16713a45db5fac02429a23fb5f3ffd4b01d4a6aaa67d3
s390x dotnet-apphost-pack-10.0-10.0.13-1.el9_8.s390x.rpm 475c02a040fe18d11d02b5010f0316991b7d4dcc2c128f32920f0db38c05b5e4
s390x aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8.s390x.rpm 645de944c76f4428c47324693637cae69621685cb629a05c2fd9827af9b36cf3
s390x aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8.s390x.rpm 725204b668035aad9066fb3e56b6bc353522955e3e4681f69302c5c627483330
s390x dotnet-host-10.0.13-1.el9_8.s390x.rpm 72653cb4b2f213c2b51ed01155468e160b4eaa9f328b23c11f27fc23ddfc21e1
s390x dotnet-sdk-10.0-10.0.113-1.el9_8.s390x.rpm 9c5f3185501b0bfd9f29f66f45a4359a54be8ffea3db9684619f95551336a2a4
s390x dotnet-templates-10.0-10.0.113-1.el9_8.s390x.rpm a32d0010bdf9f8eb4dfcb0c0d4004f06b8c7bc94799a396099f0e65651a6558a
s390x dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.s390x.rpm bf9d8673198f4509d865fa19ae0a7b6e6ae4ffac98a574e77e843331f92a1d7d
s390x aspnetcore-runtime-10.0-10.0.13-1.el9_8.s390x.rpm c8c5e3c007f96bcae789d0d0fc9bad917d50b3ceb5f24de50df40675c6efb927
s390x dotnet-runtime-10.0-10.0.13-1.el9_8.s390x.rpm d273d238cdefb7f0fa77d47c56c241f7cc6dd85fba329e937b09e3b276fddaac
s390x dotnet-targeting-pack-10.0-10.0.13-1.el9_8.s390x.rpm daa6b46f909e2c52c11e2f7aedf234eb5294e4f123e85259504e177ba1fd7b40
x86_64 dotnet-runtime-dbg-10.0-10.0.13-1.el9_8.x86_64.rpm 0d2f97fdb5ff54d5812d70e4566c4d0d1e4f802032c0eed594b2a2a944492514
x86_64 dotnet-apphost-pack-10.0-10.0.13-1.el9_8.x86_64.rpm 36b8adaa078e2f391d3d1fec8e746653e6045f2c0944f5167ee8f64992b5a75b
x86_64 dotnet-sdk-dbg-10.0-10.0.113-1.el9_8.x86_64.rpm 400735bad84a82866f9c597520eb9096badb47c5c8b4b1ce4d971aa078e1c1a2
x86_64 dotnet-runtime-10.0-10.0.13-1.el9_8.x86_64.rpm 4cb9561a8b65b394e1e9b07e6c75648795f607c1188bdbbf96381cf4553f6935
x86_64 dotnet-sdk-aot-10.0-10.0.113-1.el9_8.x86_64.rpm 56a8b8fa960384da1ae7e16e6c0f333c95986f1c2de2b30673d50e47f3d21cb0
x86_64 aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8.x86_64.rpm 642dd3d556bb1e2d0e9edfc41582cc767cfe662319116ad28dd441831e3a3d16
x86_64 aspnetcore-runtime-10.0-10.0.13-1.el9_8.x86_64.rpm 6915316c2e0ec509cc232d84f8fa04f67373679d3f876eb1f84bc1b1d2582d9b
x86_64 aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8.x86_64.rpm 793d7818ea3ab282c6dbb2c162f11f59d21927ae61dff714c6100b968b759a25
x86_64 dotnet-hostfxr-10.0-10.0.13-1.el9_8.x86_64.rpm 82e621dfe9bd97a4fe66e02e57178c8466eade6565a502f70a42e81a9ec53b9a
x86_64 dotnet-targeting-pack-10.0-10.0.13-1.el9_8.x86_64.rpm 9d90c8427b62913b8f118c8c8d65ea0924f241997558c8b728d20c466cdee8b1
x86_64 dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.x86_64.rpm bbe239272f8e43a1de50f570b2341a339b8187f9dc92331c185605b6a36d9c40
x86_64 dotnet-sdk-10.0-10.0.113-1.el9_8.x86_64.rpm cb2e68fec91f0fcdb4682b056e9b93c7854ce83e19abdd3b27edef4dfc121a34
x86_64 dotnet-host-10.0.13-1.el9_8.x86_64.rpm e07647e329e7ab67c7289c53ac5cd559d634941bdb8455449c924d062e91a1a9
x86_64 dotnet-templates-10.0-10.0.113-1.el9_8.x86_64.rpm fc3f1ee7fcc277f33c41c2a45b55ff264a68a7c2cfad9ccbf130db283e59e98a
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.