alsa-2026:41900
Vulnerability from osv_almalinux
Published
2026-07-20 00:00
Modified
2026-07-31 12:30
Summary
Important: .NET 10.0 security, bug fix, and enhancement update
Details
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "aspnetcore-runtime-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "aspnetcore-runtime-dbg-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "aspnetcore-targeting-pack-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-apphost-pack-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-host"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-hostfxr-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-runtime-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-runtime-dbg-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-sdk-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-sdk-10.0-source-built-artifacts"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-sdk-aot-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-sdk-dbg-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-targeting-pack-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dotnet-templates-10.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.110-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": ".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. \n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. \n\nSecurity Fix(es): \n\n * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)\n * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)\n * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)\n * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)\n * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)\n * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)\n * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)\n * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)\n * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)\n * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)\n * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)\n * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)\n * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)\n * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)\n * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)\n * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)\n * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)\n\n\nBug Fix(es) and Enhancement(s): \n\n * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:41900",
"modified": "2026-07-31T12:30:47Z",
"published": "2026-07-20T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:41900"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47300"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47302"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47303"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47304"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50524"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50525"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50526"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50527"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50528"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50646"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50648"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50649"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50650"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50651"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-50659"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-56170"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-57108"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2499217"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500109"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500189"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500492"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500502"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500509"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500515"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500556"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500562"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500563"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500565"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500577"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500580"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500581"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500587"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2500593"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-41900.html"
}
],
"related": [
"CVE-2026-50651",
"CVE-2026-57108",
"CVE-2026-56170",
"CVE-2026-47300",
"CVE-2026-47303",
"CVE-2026-47304",
"CVE-2026-47302",
"CVE-2026-50650",
"CVE-2026-50528",
"CVE-2026-50649",
"CVE-2026-50526",
"CVE-2026-50646",
"CVE-2026-50525",
"CVE-2026-50527",
"CVE-2026-50648",
"CVE-2026-50659",
"CVE-2026-50524"
],
"summary": "Important: .NET 10.0 security, bug fix, and enhancement update"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…