ALSA-2026:99053: Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.115 Runtime version: 10.0.15
Security Fix(es):
dotnet8.0: dotnet11.0: dotnet9.0: dotnet10.0: ASP.NET Core Information Disclosure Vulnerability (CVE-2026-109476) dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-105544) dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: .NET Denial of Service Vulnerability (CVE-2026-109475) dotnet9.0: dotnet11.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114146) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114147) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114149)
Bug Fix(es) and Enhancement(s):
Update .NET 10.0 to SDK 10.0.115 and Runtime 10.0.15 (JIRA:RHEL-302519)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/aspnetcore-runtime-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/aspnetcore-runtime-dbg-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/aspnetcore-targeting-pack-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-apphost-pack-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-hostfxr-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-runtime-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-runtime-dbg-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-10.0to a version that resolves this vulnerability.Fixed in 10.0.115-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-10.0-source-built-artifactsto a version that resolves this vulnerability.Fixed in 10.0.115-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-aot-10.0to a version that resolves this vulnerability.Fixed in 10.0.115-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-sdk-dbg-10.0to a version that resolves this vulnerability.Fixed in 10.0.115-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-targeting-pack-10.0to a version that resolves this vulnerability.Fixed in 10.0.15-1.el8_10 - Upgrade
Upgrade
almalinux/dotnet-templates-10.0to a version that resolves this vulnerability.Fixed in 10.0.115-1.el8_10 - Upgrade
Upgrade
.NET SDKto a version that resolves this vulnerability.Fixed in 10.0.115 - Upgrade
Upgrade
.NET Runtimeto a version that resolves this vulnerability.Fixed in 10.0.15
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which .NET components are covered by this update?
The update covers .NET 10.0 SDK 10.0.115 and Runtime 10.0.15. Listed packages include the .NET runtime, SDK, hostfxr, apphost pack, targeting pack, ASP.NET Core runtime, and associated debug packages.
What security impact types are addressed?
The advisory addresses ASP.NET Core information disclosure, .NET and ASP.NET Core elevation of privilege, and .NET and ASP.NET Core denial-of-service vulnerabilities. The listed CVEs are CVE-2026-109476, CVE-2026-105544, CVE-2026-109475, CVE-2026-114146, CVE-2026-114147, and CVE-2026-114149.
Are ASP.NET Core deployments affected?
Yes. The update lists multiple ASP.NET Core issues, including information disclosure, elevation of privilege, and denial of service, and includes the aspnetcore-runtime-10.0 package among the affected software.