ALSA-2026:99051: Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 9.0.124 Runtime version: 9.0.23
Security Fix(es):
dotnet8.0: dotnet11.0: dotnet9.0: dotnet10.0: ASP.NET Core Information Disclosure Vulnerability (CVE-2026-109476) dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-105544) dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: .NET Denial of Service Vulnerability (CVE-2026-109475) dotnet9.0: dotnet11.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114146) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114147) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114149)
Bug Fix(es) and Enhancement(s):
Update .NET 9.0 to SDK 9.0.124 and Runtime 9.0.23 (JIRA:RHEL-302540)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/aspnetcore-runtime-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/aspnetcore-runtime-dbg-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/aspnetcore-targeting-pack-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-apphost-pack-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-hostfxr-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-runtime-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-runtime-dbg-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-9.0to a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-9.0-source-built-artifactsto a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-aot-9.0to a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-dbg-9.0to a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-targeting-pack-9.0to a version that resolves this vulnerability.Fixed in 9.0.23-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-templates-9.0to a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
almalinux/netstandard-targeting-pack-2.1to a version that resolves this vulnerability.Fixed in 9.0.124-1.el8_10 - Upgrade
Upgrade
.NET 9.0 SDKto a version that resolves this vulnerability.Fixed in 9.0.124 - Upgrade
Upgrade
.NET 9.0 Runtimeto a version that resolves this vulnerability.Fixed in 9.0.23
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which .NET 9 components should be included in remediation scope?
The affected package set includes the .NET 9 SDK, runtime, runtime debug package, hostfxr, apphost pack, targeting pack, ASP.NET Core runtime, and ASP.NET Core runtime debug package. Systems using any of these listed AlmaLinux packages should be reviewed.
What versions does this update provide?
The update moves .NET 9.0 to SDK version 9.0.124 and Runtime version 9.0.23.
Which vulnerability categories are addressed for the .NET 9 package set?
The advisory addresses ASP.NET Core information disclosure and elevation-of-privilege issues, .NET elevation-of-privilege issues, and .NET and ASP.NET Core denial-of-service issues. The listed CVEs apply to dotnet9.0 along with other .NET major versions.